CONCLUSION

TL;DR: This training taught you the adversarial mindset behind building evasive shellcode loaders that bypass common detection mechanisms. You now understand how attackers think, how AV/EDR products work, and the techniques used to evade them. The loader we built is educational—real-world implementations require far more sophistication. Remember: every security product has unique detection mechanisms, and what bypasses one may not work against another.

SURVEY:

image

We would like it very much if you could take 5 minutes to fill out the following survey to help us improve future trainings: Training Feedback Survey, we would be eternally grateful!

Downloading the course material:

You can download all the labs, tools and course material from the links below - please note this material is copyright, so do not distribute and do not upload any code or compiled binaries to online virus scanning services or sandboxes,

1. TRAINING OBJECTIVES & SCOPE

What We Covered

The main goal of this training was to teach you a certain mindset on how adversaries think and operate when building loaders that can bypass common detection mechanisms. By understanding these techniques, you will be better equipped to analyze, detect, and respond to such threats in real-world scenarios.

Key Learning Outcomes:

  • Understanding AV/EDR architecture and detection engines (static, dynamic, behavioral, emulation)
  • Building a modular shellcode loader from scratch
  • Implementing AMSI and ETW bypass techniques
  • Using D/Invoke to avoid static IAT analysis
  • Applying anti-emulation techniques to evade sandbox detection
  • Understanding string obfuscation and XOR encoding methods
  • Analyzing our own code with forensic tools (PE Studio, CAPA, GoCheck64, strings)

Important Context

CRITICAL: This loader is not intended to be undetectable in a production environment. Real-world scenarios require much more complex and sophisticated implementations. Every security product has its own detection mechanisms, and what works against one may not work against another. The techniques demonstrated here are for educational purposes only and should be used responsibly.

2. OUR LOADER: WHAT WE BUILT

Core Implementation

We successfully built a modular shellcode loader using standard Windows APIs:

  • VirtualAlloc: Memory allocation for shellcode
  • WriteProcessMemory: Writing shellcode to allocated memory
  • CreateThread: Executing the shellcode in a new thread

Evasion Techniques Implemented:

  • AMSI Bypass: Patching the AmsiScanBuffer function to prevent script content inspection
  • ETW Patching: Disabling Event Tracing for Windows to avoid behavioral telemetry
  • D/Invoke (Dynamic Invoke): Resolving Windows APIs at runtime to avoid static IAT signatures
  • Anti-Emulation: DNS TXT record validation and time-based checks to detect sandboxed environments
  • String Obfuscation: XOR encoding and Base64 encoding to hide suspicious strings
  • Staged Payload Delivery: Retrieving encrypted payloads from remote servers

Limitations & Reality Check

Obviously, this is just a basic implementation. In a real-world scenario, additional layers of obfuscation, encryption, and anti-analysis techniques would be necessary to further enhance the loader's stealth and effectiveness.

3. ADVANCED TECHNIQUES (BEYOND THIS TRAINING)

3.1 Alternative API Approaches

  • Windows NT API (Native API): Using lower-level APIs like NtAllocateVirtualMemory instead of VirtualAlloc makes detection harder. Avoiding high-level functions like CreateThread reduces behavioral signatures.

  • Direct/Indirect Syscalls: Bypassing user-mode API hooks entirely by invoking system calls directly from user-mode code. This is extremely effective against EDR products that rely on user-mode hooking.

3.2 Remote Process Injection Techniques

Remote process injection techniques can hide payload execution within legitimate processes, making detection significantly harder:

  • Process Hollowing: Unmapping legitimate process memory and replacing it with malicious code
  • Thread Hijacking: Suspending legitimate threads and redirecting execution to malicious code
  • APC (Asynchronous Procedure Call) Injection: Queuing malicious code execution in existing thread APC queues
  • Reflective DLL Injection: Loading DLLs directly from memory without touching disk
  • Process Doppelgänging: Abusing NTFS transactions to load malicious images
  • Process Herpaderping: Obscuring process image on disk after loading into memory

3.3 Kernel-Level Attacks

Attacking AV/EDR directly is commonly done by using vulnerable drivers to disable or bypass security products (BYOVD - Bring Your Own Vulnerable Driver):

  • Kernel-level attacks are much more effective but also more complex and risky
  • Requires signed drivers (often abusing legitimate vulnerable drivers)
  • Can disable security products, remove callbacks, or modify kernel memory
  • Examples: Terminating protected processes, disabling ETW providers, removing minifilter drivers

NOTE: We have focused on user-mode techniques in this training. Kernel-level attacks require deeper knowledge and carry significantly higher risks of system instability.

3.4 Integration Possibilities

Consider these techniques as additional layers that can be integrated into the loader to further enhance its stealth and evasion capabilities. Each layer adds complexity but also increases the chances of bypassing modern security solutions.

And who knows, maybe we are already working on an advanced version of this loader for a future training ;)

4. DEFENSIVE PERSPECTIVE: FORENSICS

When analyzing systems for forensic purposes, it's crucial to understand the techniques used by loaders like the one we built. There are many more tools and techniques that can be used to analyze and detect such loaders.

4.1 Forensic Analysis Techniques

Memory Forensics:

  • Tools: Volatility
  • Use Cases: Analyze memory dumps for signs of injected code, hollow processes, or anomalous memory regions
  • Detection: Identify suspicious memory permissions (RWX), unbacked memory sections, or process token manipulation

Behavioral Analysis (Sandboxes):

  • Tools: Cuckoo Sandbox, Any.Run, Joe Sandbox
  • Use Cases: Monitoring system behavior during execution to identify suspicious activities
  • Detection: Network connections, file modifications, registry changes, process injections

Static Analysis:

  • Tools: PE Studio, CAPA, SystemInformer, dnSpy (for .NET)
  • Use Cases: Analyzing the binary structure, imports, strings, and capabilities
  • Detection: Suspicious imports, obfuscated strings, packer signatures, entropy anomalies

Debugging and Disassembly:

  • Tools: x64dbg, WinDbg, IDA Pro, Ghidra, Binary Ninja
  • Use Cases: Reverse-engineering the loader to understand its inner workings
  • Detection: Identifying unpacking routines, decryption algorithms, or anti-debugging tricks

NOTE: Comprehensive forensic analysis would require another full training dedicated to these techniques. We've provided the foundational understanding needed to get started.

5. DEFENSIVE PERSPECTIVE: INCIDENT RESPONSE

In an incident response scenario, detecting and mitigating threats posed by loaders like the one we built is critical. Here are key strategies that can be employed:

5.1 Detection Strategies

Endpoint Detection and Response (EDR) Solutions:

  • Deploy EDR solutions that monitor for suspicious behaviors
  • Alert on unusual memory allocations, process creation chains, or API call patterns
  • Implement behavioral detection rules for common injection techniques
  • Monitor for IAT tampering, inline hooking, or AMSI/ETW bypass attempts

Network Monitoring:

  • Analyze network traffic for signs of command-and-control (C2) communications
  • Detect data exfiltration attempts or unusual outbound connections
  • Monitor DNS queries for suspicious domains or TXT record queries
  • Implement SSL/TLS inspection to detect encrypted C2 channels

Threat Intelligence:

  • Leverage threat intelligence feeds to stay updated on the latest TTPs (Tactics, Techniques, and Procedures)
  • Integrate YARA rules and IOC (Indicators of Compromise) feeds
  • Participate in information sharing communities (ISACs, CERTs)

5.2 Response Procedures

Incident Response Playbooks:

  • Develop and follow incident response playbooks outlining steps for loader detection
  • Containment: Isolate affected systems, block C2 communications
  • Eradication: Remove malicious artifacts, restore compromised files
  • Recovery: Restore systems from clean backups, validate integrity
  • Lessons Learned: Document incidents, update detection rules

User Education and Awareness:

  • Train users to recognize phishing attempts and social engineering tactics
  • Implement security awareness programs focusing on email attachments and malicious links
  • Conduct regular red team exercises to test organizational readiness

5.3 Tools We Covered

We have focused on Velociraptor and Sysmon in this training, but there are many more tools and techniques that can be used in incident response scenarios. These provide the foundation for building a robust detection and response capability.

6. FINAL THOUGHTS

Thank you for completing this training! You should now have a solid understanding of:

  • How to build a modular shellcode loader that can bypass common detection mechanisms
  • How AMSI and ETW can be bypassed and what defenders can do about it
  • How D/Invoke and dynamic API resolution work to evade static analysis
  • How to implement anti-emulation techniques to evade sandbox detection
  • The offensive mindset required to build evasive tools
  • The defensive perspective needed to detect and respond to such threats

Key Takeaways

  • Offense informs defense: Understanding attacker techniques makes you a better defender
  • Defense informs offense: Understanding detection mechanisms makes you a better red teamer
  • Layered approach: Both attack and defense require multiple layers—no single technique is foolproof
  • Continuous learning: The cat-and-mouse game between attackers and defenders never ends

We have provided you with the basic insights into forensic analysis and incident response related to such loaders. The techniques and tools covered here form the foundation for both offensive security assessments and defensive operations.

7. DISCLAIMER

IMPORTANT: The techniques and methods discussed in this training are intended for educational purposes only. Unauthorized use of these techniques on systems without explicit permission is illegal and unethical. Always ensure you have proper authorization before conducting any security testing or assessments.

Legal Considerations:

  • Obtain written permission before testing on any system
  • Operate within the scope of your authorized engagement
  • Comply with all applicable laws and regulations
  • Use these techniques responsibly and ethically
  • Report vulnerabilities through responsible disclosure channels

Ethical Guidelines:

  • Never use these techniques for malicious purposes
  • Respect privacy and confidentiality
  • Understand the impact of your actions on systems and users
  • Continuously educate yourself on legal and ethical boundaries
  • Contribute positively to the security community

Technology is only as good as the knowledge of the people using it!