EDRs & Shellcode Loaders

Topics Covered

Credits

Shellcode Loaders 101

API Call Flow

Image stolen from here

AV & EDRs

EDR hook on NtQueueApcThread
No hooks on NtQueueApcThread
code to unhook ntdll.dll
Before unhooking ntdll.dll
After unhooking ntdll.dll
Corresponding assembly code of the embedded syscall instructions
Syscall instructions identified from static analysis
Corresponding assembly code of the improved technique to jump to syscall instructions within ntdll.dll
ETW generating an event for allocation of memory (CreateSegment)
ETW generating an event for the creation of a thread (ThreadCreated)
Code to patch EtwEventWrite in a local process
Before patching EtwEventWrite
After patching EtwEventWrite
Before patching EtwEventWrite in a remote process
After patching EtwEventWrite in a remote process
Word spawning PowerShell
Code to spawn a suspended wermgr process as a child of chrome
wermgr spawned in a suspended state as a child of chrome

Execution Methods

Conclusion

Mid-grade meme

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store