Damon Mohammadbagher ✅Jun 28, 2023

some little bit codes added to my Blue team code to detect some opcodes in injected bytes (especially for this DripLoader or something like this code)
this update version still needs some codes to be better but i working on this hard ;D , just for test some codes in Driploader.cpp was changed by me only for test ;)

i Tested old Loader called "#DripLoader" , and this will bypass ETW events but my blue team tool not fully bypassed and code was detected...
background of this code is really nice and i working on this so maybe you want to see what happened in my test about this as #pentester or #Redteamer this will help you to better understanding ETW or other #eventbased #detections .

as #blueteamer you can see this with this method sometimes your tools will confuse very simple ;p in these pictures you can see startaddress via ETW was not Detected correctly.

Note: it does not mean that sartaddress is fake, i just want to say that startaddress 0x7ffca90... is not about shell code which started with bytes {0xb8 , 0x00 , 0x00 , 0xdd, 0xdd},its about jmp,Mov/BaseAddress/0xdddd0000 & you can find that bytes in C++ source code of driploader:

line 12 of DripLoader.cpp
unsigned char jmpSc[7] {0xB8,b[0],b[1],b[2],b[3],0xFF,0xE0};

worth to read =>
more detail about background of code: https://lnkd.in/ekpHUBsv

this code was added to my list long time ago => https://lnkd.in/eeStM9C

#blueteam #tools #redteam #pentesting #avs #edr #socanalyst #soc
#etw #threadinjection #threathunting #threatdetection

Bypassing EDR real-time injection detection logic

Damon Mohammadbagher ✅Jan 11, 2023
#chatgpt #youdotcom #learning #blueteam #redteam #pentesting #securityresearch #defensive #ai
in last post i talked about blue-teaming, now i want to share something for red-teaming via "Chatgpt" or "YOUdotCOM" as Security Researcher you can see with very simple trick you can find very useful codes here "YOU.COM" which is useful for #pentester or #redteamer , in this case i searched this "write server-side code in C# for/to get bytes over port 8080 and get context" or something like that , and i had this result by #AI so with little bit changing code i made my very simple Sever-Side C2 only with (50-60 lines server side code), as you can see with very simple code via "Chatgpt" or you-dot-com you can make your own simple C2 Server core codes (networking) or ... but in this case my code executed in server side but i can change that then instead server side my CMD will run in Client-side & vice versa ;D, so as #Penester / #Redteamer and #blueteamer this will help you a lot , also this will be useful for Cyber security Instructors to learn new things better/faster also teaching them better etc
i wrote this code only in 10 mins , because i created my own C2 server with some techniques like this in C# but my core code in background worked with Async Methods and this code almost is similar to my core codes in my own C2 which i created 2-3 months ago so i made this code very fast because i had experience for working with them, but probably for you, this will take time more than 10 mins ;), maybe not, anyway as you can see for learning cyber security things , these platforms are awesome so this one was simple Example for Red-teaming
Rysiekúr (old account)May 23, 2018
Hey #InfoSec, anybody can suggest a good #BlueTeamer, some #RedTeam experience welcome, good sysadmin skills very welcome, preferably somewhere in the American timezones, interested in remote work?
 xoreaxeax Dec 13, 2017

#introduction - currently a #blueteamer. Enjoys learning new things. Considers red and blue team to be yin and yang of #infosec. Occasionally play #ctf.

I would like to thank @jerry for running and @tinker for the nudge towards this platform. :)