Search Evasion Techniques
Names, Techniques, Definitions, Keywords
Search Result
26 item(s) found so far for this keyword.
Process Injection: Dynamic-link Library Injection Defense Evasion [Mitre]
Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process …
C2 via FTP(S) Network Evasion
C2 via FTP is a technique that utilizes the File Transfer Protocol (FTP) to establish command and control communication between an attacker and victim systems. It involves sending commands and receiving responses within FTP sessions, effectively using FTP as a conduit for covert communication.
To implement C2 via FTP, an attacker needs control over an FTP server, and must …
Process Argument Spoofing Process Manipulating
Process Argument Spoofing is a technique used by attackers to hide their true intentions by changing the command line arguments of a process after it has started.
PowerShell Special Characters Obfuscation Data Obfuscation
PowerShell scripts can be obfuscated using methods that encode commands exclusively with special characters. This technique aims to complicate analysis and potentially evade detection mechanisms.
Attackers frequently employ these tactics to hide the true functionalities of the script, making the analysis more challenging.
AppInit DLL Injection Process Manipulating Defense Evasion [Mitre]
Any Dynamic Link Libraries (DLL) that are specified within the AppInit_DLLs registry key values are loaded by user32.dll into any process that utilizes user32.dll. So by modifying the AppInit_DLLs registry key value and pointing it to a malicious DLL, an attacker can force the system to load their DLL into every process that utilizes user32.dll and force it to execute …
VBA Purging Antivirus/EDR Evasion
VBA Purging is an obfuscation technique designed to evade detection mechanisms used in malware analysis. When a VBA macro is added to a Microsoft Office document, it is stored in two sections: the PerformanceCache (compiled VBA code) and the CompressedSourceCode (compressed VBA source code). In VBA Purging, the PerformanceCache (compiled code) is completely removed from the module stream, along with …