VirtualAllocEx

This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)...

VirtualAlllocEx

This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.

VirtualAlllocEx

Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged

VirtualAlllocEx

Depending on the AV/EDR we will check which Windows APIs are hooked by the AV/EDR

VirtualAlllocEx

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

VirtualAlllocEx

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

VirtualAlllocEx

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

VirtualAlllocEx

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service p...

VirtualAlllocEx

This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly

VirtualAlllocEx