Unprotect Navbar Version Logo
  • Home
  • Techniques
  • Scan
  • Resources
    • Snippet List
    • Detection Rule List
    • Featured Evasion API List

    • Contributors

    • Scanned Samples
  • Tools
  • About
  • Avatar Login

Search For Content

Clear

Search Result

4 item(s) found so far for this keyword.

File Melt

Others icon
Others

File melting is a technique that malware uses to delete itself after it has been installed on a system. This is often done in order to avoid detection by antivirus programs or other security measures. The process of file melting involves overwriting the file with random data, making it impossible to recover the original file or to detect the presence …

Read more

System Binary Proxy Execution: MMC

Defense Evasion [Mitre] icon
Defense Evasion [Mitre]

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These …

Read more

Volume Shadow Copy Service (VSC,VSS) Deletion

Anti-Forensic icon
Anti-Forensic
Defense Evasion [Mitre] icon
Defense Evasion [Mitre]

Deleting Volume Shadow Copy makes the forensic investigation more difficult in terms of the recovery of previous artifact evidence. In addition, attackers using ransomware often delete VSCs not to be able to recover the original files of the encrypted files from VSCs.

On the other hand, deleting by using vssadmin and WMIC is on a file system level, the …

Read more

Subvert Trust Controls: Code Signing Policy Modification

Defense Evasion [Mitre] icon
Defense Evasion [Mitre]

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.

Some …

Read more

The #UnprotectProject is brought to you by 🇫🇷 DarkCoderSc and 🇫🇷 fr0gger_

Terms And Conditions | GDPR

Contribute Now