Now that we have covered how to evade detection on disk, let's focus
our attention on heuristics. As explained in the antivirus and EDR
module, many techniques are leveraged by antivirus and EDR to detect
malicious activity. In this module,
we will take a look at how we can get around many of these security
mechanisms using a variety of different techniques.
We will start by discussing how API monitoring can be evaded.
I will show you how to improve our stager so that it
will remove any API hooks at runtime,
which in turn might be enough to blind certain antivirus solutions.
We shall then discuss anti‑emulation and anti‑sandboxing techniques.
We will also take a closer look at how AMSI can be evaded by
rewriting our stager in PowerShell and using various techniques to
ensure it doesn't get flagged when executed.
Finally,
we will go through a demo where we will improve our stager and
partially bypass Windows Defender at runtime.