Now that we have a good understanding of how Meterpreter works,
if you want to get past defenses,
we need to understand at a high level how defenses work and why they might be
able to block or detect Meterpreter stages and payloads.
We will focus here on antivirus and endpoint detection and response solutions,
also known as EDR.
We will cover the main components that make up most antivirus and EDR solutions,
and we will look at the type of detections that we may encounter.
I will demonstrate how many of the techniques used
to detect our tradecraft work.
We will cover emulation and API monitoring,
kernel‑mode drivers, and event tracing for Windows,
as well as AMSI.
Understanding these technologies will help you understand many of the evasion
techniques, which we will be looking into during the course.
Endpoint security solutions, such as antivirus and EDR,
are usually made up of multiple components.
First, we have kernel‑mode drivers,
which can be leveraged to install callback routines,
which will be notified when certain events occur on the system.
File system filter drivers and network drivers are also used extensively by
antivirus and EDR to monitor file system and network activity.
Next, we have user‑mode services.
This is usually the component which communicates with cloud
services and centralizes all the data collected on the
endpoint so that it can be correlated.
In some cases, we may encounter API monitoring constructs,
which can be leveraged to gain insight into process behavior.
You may also encounter event tracing for Windows,
also known as ETW. ETW providers can be consumed by security solutions to
collect additional telemetry about events occurring on the system.
Next, we have emulators and sandboxes, which are also used by some
solutions to analyze files and scripts dynamically to gain insight into
their runtime behavior. And finally, we have AMSI providers, which can be
registered to scan scripts at runtime.