QUESTION. Is it a way to work arround memory scanner with a sliver implant.

[kamisw03]

Advanced EDR and AV can catch sliver implants even if they use SGN. i am wondering if there is a better way to work around this.?

[moloch--]

Typically memory scans are triggered via process behavior or based on a timer, avoiding the memory scan triggers is typically the best way to evade them.

[rkervella]

Advanced EDR and AV can catch sliver implants even if they use SGN

This might be due to a combination of things, one of them being the obfuscator missing some key elements that are currently used as IOCs.

[rkervella]

Sliver shellcodes are built using go-donut, which is a go implementation of donut. This means that any artifacts or suspicious behavior that donut leaves or generates, Sliver will probably have them.