Open-Source Software

Option 1: Manually Breaking Signatures

  1. Compile the software

  2. Use a tool like ThreatCheck to locate which bytes trigger a detection

  3. Modify the source code accordingly

  4. Repeat until the binary is undetected

Switch from Debug to Release mode, and build the project

Replacing the string ticket with another and then checking if the program is still detected (and if it still works)

[Ctrl] + [Shift] + H inside Visual Studio -Replace ticket with tekcit and hit Replace All.

Replacing all instances of the string "Key" with something else like we did with "ticket" would break the software since built-in functions like ContainsKey also contain this string.

Find in Files window in Visual Studio by hitting [Ctrl] + [Shift] + F, enter "DiffieHellmanKey" and click Find All to figure out where this is in the code

DiffieHellmanKey.cs. Opening it up, we can rename the DiffieHellmanKey class to DHKey by right-clicking the name and selecting Rename

After renaming the class to DHKey, let's rebuild the project and scan it once more with ThreatCheck. The bytes that triggered a detection contain "Rubeus", some copyright information and a GUID.

Change the GUID to something random

Project > Rubeus Properties and then Application > Assembly Properties. Here, we can update the GUID to the one we just generated, hit OK, rebuild the solution and scan it with ThreatCheck once again.

And so on...

Option 2: Reflectively Loading Assemblies in PowerShell

Let's say we have a C# assembly which has a namespace called Example, which contains a class called Program, which contains a method called Main. We could load the assembly and execute this method in PowerShell like so:

LogoPowerSharpPack/PowerSharpBinaries/Invoke-Seatbelt.ps1 at master · S3cur3Th1sSh1t/PowerSharpPackGitHub

Open Seabelt. In order for PowerShell to be able to interact with methods from reflectively-loaded assemblies, they need to have public visibility. In our case, we'll need to open Program.cs and change the Main method from private to public.

When we write our PowerShell script, we will need to store this assembly in a variable, so let's use CyberChef to compress and encode it with GZIP and Base64 respectively.

First off, we can prepare a function called Invoke-Seatbelt which takes one string argument (which we will later pass to Seatbelt) and contains the compresed and encoded Seatbelt assembly we prepared earlier.

Before we are able to load the assembly, we need to convert it back into its original bytes, so we can add the following lines to decode and then decompress the $gzipB64 variable.

With the assembly bytes back in their original form, we can add the following lines to load the assembly reflectively, redirect STDOUT to the console and then invoke the Main method with the arguments passed to the Invoke-Seatbelt function.

This happens, because this specific AMSI bypass utilized only disables AMSI for the PowerShell session. So with that in mind, we need to pick a bypass which patches amsi.dll

AMSI Bypass

All Code:

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

  • Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems The author uses his years of experience as a red team operator to investigate each of the most common sensor components, discussing their purpose, explaining their implementation, and showing the ways they collect various data points from the Microsoft operating system. In addition to covering the theory behind designing an effective EDR, each chapter also reveals documented evasion strategies for bypassing EDRs that red teamers can use in their engagements.

PreviousProcess InjectionNextUser Access Control (UAC)

Last updated