Geofencing Others

Geofencing in malware refers to a technique used by cybercriminals to restrict the distribution or activation of malicious software based on geographical location. Malware authors use geofencing to target specific regions or avoid certain areas, such as their home country, in order to evade detection, minimize the chances of being investigated, or maximize the effectiveness of their attacks.

Geofencing …

Shortcut Hiding Antivirus/EDR Evasion

Windows shortcut can be used to store code that downloads a malicious file from the internet, or that stores the malicious file directly within the shortcut itself. This can make it difficult for antivirus software to detect the malicious application, as the file is not stored in a typical location on the computer. Additionally, the use of a shortcut can …

Stolen certificate Antivirus/EDR Evasion

To avoid detection, attackers can use stolen certificates from known companies. It allows the malware to bypass security solution.

NtSetDebugFilterState Anti-Debugging

The NtSetDebugFilterState and DbgSetDebugFilterState functions are used by malware to detect the presence of a kernel mode debugger. These functions allow the malware to set up a debug filter, which is a mechanism that can be used to detect and respond to the presence of a debugger.

When a kernel mode debugger is present, the debug filter will be …

Injection using Shims Process Manipulating

Microsoft provides Shims to developers mainly for backward compatibility. Shims allow developers to apply fixes to their programs without the need of rewriting code. By leveraging shims, developers can tell the operating system how to handle their application. Shims are essentially a way of hooking into APIs and targeting specific executables. Malware can take advantage of shims to target an …

PE Injection Process Manipulating

Instead of passing the address of the LoadLibrary, malware can copy its malicious code into an existing open process and force it to execute (either via a small shellcode, or by calling CreateRemoteThread).

One advantage of PE injection over the LoadLibrary technique is that the malware does not have to drop a malicious DLL on the disk. The …

Inline Hooking Process Manipulating

Inline hooking is a technique used to intercept calls to target functions. It is commonly used by antiviruses, sandboxes, and malware to perform a variety of tasks, such as checking parameters, shimming, logging, spoofing returned data, and filtering calls.

The process of inline hooking involves directly modifying the code within the target function, usually by overwriting the first few …

NOP Sled Anti-Disassembly

In computer security, a NOP slide is a sequence of NOP (no-operation) instructions that is inserted at the beginning of a code section. When a program branches to the start of this code section, it will "slide" through the NOP instructions until it reaches the desired, final destination. This technique is commonly used in software exploits to direct program execution …

Indicator Removal: Clear Windows Event Logs Anti-Forensic Defense Evasion [Mitre]

Event logging is a process that records important software and hardware events from various sources and stores them in a centralized location called an event log. This service is commonly used by applications and operating systems to track and troubleshoot issues, and can be a valuable tool for forensic investigations.

Event logs can provide valuable information about the actions …

Wiping or Encrypting Anti-Forensic

Anti-forensic techniques are methods used by malware to prevent security professionals from detecting and analyzing it. One way that malware can accomplish this is by using wiping or encryption techniques to remove its own trace from the system.

In some cases, malware may use wiping or encryption as a decoy, in order to distract security professionals and hide its …

Search Evasion Techniques

Search Result