Now that we have covered how defenses can be evaded on
disk, at runtime, and in memory,
let's now take a look at how we can avoid detection on the network.
In some environments, this is extremely easy to achieve.
In highly secured environments, however,
one might come across various systems such as intrusion
detection and intrusion prevention solutions,
web proxies, and firewalls, to name a few.
These systems are designed to detect or block
potentially malicious activity on the network.
If you have been following along in the course,
you will have noticed that I have been using the Reverse
HTTP Meterpreter stagers and payloads.
The main reason I chose to use them is because they blend in very nicely with
common network traffic patterns in most corporate networks.
During this module,
we will take a look at how we can fly under the radar by
applying various techniques which will improve our
tradecraft's evasiveness on the network.
We will be taking a look at how we can encode the
Meterpreter payload and extensions.
We will also discuss how SSL certificates and Ja3 hashes
can jeopardize your Meterpreter sessions.
I will also give you some tips and tricks which may
be used to keep a low profile.
Finally,
we will go through a demo where we will bypass Windows Defender on
disk, at runtime, in memory, and over the network,
as well as evading network‑level detection systems consisting
of a Squid proxy tied into the open source Clam AntiVirus
engine using the ICAP protocol.