winternl

cybersecurity & programming

Author: winternl

  • Dealing with Failure: Failure Escalation Policy in Unmanaged CLR Hosts

    —

    by

    winternl

    Offensive tooling built upon the .NET framework and its runtime environment, the Common Language Runtime (CLR), is an important part of the red teaming ecosystem. .NET tools offer rapid development times, a low barrier to entry, and are highly extensible through native interoperability. These tools have been and will continue to be used effectively on…

  • Detecting Manual Syscalls from User Mode

    —

    by

    winternl

    By now direct system calls are ubiquitous in offensive tooling. Manual system calls remain effective for evading userland based EDRs. From within userland, there has been little answer to this powerful technique. Such syscalls can be effectively mitigated from kernel mode, but for many reasons, most EDRs will continue to operate exclusively from usermode. This…

  • Designing Emulation Resistant Control Flow

    —

    by

    winternl

    Antimalware emulators have the Sisyphean task of implementing a complete and accurate clone of the Windows environment. My previous research focused on a generic way to detect the presence of such emulators based upon Windows API artifacts. This is and will continue to be an effective technique in one’s arsenal. One of the most effective…

  • MemFuck: Bypassing User-Mode Hooks

    —

    by

    winternl

    Preface Dynamic malware analysis is the preferred way to determine the legitimacy of an application for many AVs/EDRs/MDSs. Unlike static analysis, dynamic analysis can capture and analyze Windows API calls made during the course of execution. This method of analysis provides far superior detection rates than static analysis. There are many techniques to capture such…

  • Static Detection of Portable Executable Files

    —

    by

    winternl

    Preface The cat and mouse game of the AV industry lives on into another decade. All AVs, operate on essentially three modes of detection. This post will provide a high-level overview of how AVs statically determine anomalous and heuristically incorrect PE files. These types of detections are often labeled under some vague descriptor such as…

  • Fuzzing the Windows API for AV Evasion

    —

    by

    winternl

    What is emulation? Malware Detection Systems (MDSs) use a technique called emulation as perhaps their most effective weapon against novel malware threats. Emulation does not rely on the static structure or signature of a file, but instead, executes the suspicious file for you. Of course, the MDS will not run the file on your computer,…