Jan 30, 2023

The “I can’t believe its already Jan 30!” edition

January 30, 2023

This is very interesting. Russia is sending combat robots to Ukraine for testing. It will be interesting to see how they perform, their capabilities and limitations.

-

-

-

Bypassing (some) EDR stack trace based detections

First part of this series explains the trick used to bypass EDR.

Essentially, call an ntdll function that takes a callback as an argument, rather than calling the API wrappers. To ensure the stack is clean, the ntdll function is executed in another thread. Now the code has no dodgy parent from some weird memory region.

For a load of other tricks from a bygone era, check out an article I wrote for Phrack twenty years ago. We had to release it anonymously because myself and the other co-author worked for companies that produced HIPS products. Jamey Butler wrote the shellcode included in the article. We’d agreed that everyone would be anonymous, but things didn’t work out like that.

-

-

-

-

-

-

-

Reply

or to participate.