Now that we have a good understanding of how we can
evade detection on disk and at runtime,
let's take a closer look at how we can evade in‑memory detections.
You may recall from the Meterpreter deep dive
module that the Meterpreter payload, also known as metsrv.dll,
is loaded from memory.
This also applies to all subsequent extensions which can be loaded at
runtime, such as Mimikatz and Incognito, to name a few.
Because these modules are loaded at runtime entirely from memory,
antivirus and EDR solutions will try to detect them in memory. During this
module, we will take a closer look at the options we can choose from to
make our tradecraft more evasive in memory.
We will then go through a demo where we make some modifications to the payload
and extensions in an attempt to make them harder to detect.