9. Trojan AV/EDR Evasion
9.1 Building an EDR Test Environment
| EDR | Method |
|---|---|
| Trend Micro | Kafan tutorial / TrendMicroDSAExfil (Qianxin Zero Trust has the same issue) |
| Symantec | Kafan tutorial |
| MDE | Official purchase/install (change system region) |
| General | Kafan forum download tutorials / Xianyu market |
Installation order: server first then client → after going online snapshot the VM → disconnect network before testing evasion → online samples must strip debug info and symbol tables
9.2 Blind EDR with Legitimate Drivers
Development environment: WDK → SDK first then WDK → mitigate the 143 series → wdm appears (success)
Kill user-mode Process: take the endpoint offline → ZwTerminateProcess → blackout (CLIENT_ID structure)
Disabling EDR callbacks: | Callback | Purpose | Disable method | |------|------|---------| | ObRegisterCallbacks | Process/thread handle operations (PsProcessType/PsThreadType) | CallbackList → PreOperation/PostOperation = 0 | | CmRegisterCallback | Registry access/modification | CallbackListHead → PEX_CALLBACK_FUNCTION → change to an existing doubly-linked list address (PG protection will BSOD) | | MiniFilter | File create/modify/delete | volume → FLT_VOLUMES → _CALLBACK_NODE → replace with system driver structure address | | PsSetCreateProcessNotifyRoutine | Process create/destroy | EX_CALLBACK_ROUTINE_BLOCK.Function | | PsSetCreateThreadNotifyRoutine | Thread create/destroy | same as above | | PsSetLoadImageNotifyRoutine | Image loading (EXE/DLL/driver) | same as above |
Reference: ReactOS
LOLDrivers: loldrivers.io
Kernel fuzzing tools: ioctlfuzzer (enable kernel memory dump) / ioctlbf / kDriver-Fuzzer / DIBF / kAFL / IoctlHunter / msFuzz / ioctlance
BYOVD exploitation: payson-ioctl-cheat-driver / BYOVDKit / BYOVD
9.3 Encryption and Obfuscation Evasion
Static Detection vs Evasion
| Detection method | What it detects | Evasion method |
|---|---|---|
| Signature | hash/file name/function name/sensitive strings/API / PE header/import-export/TLS/section/shellcode signatures | Segmentation / encryption-decryption (AES/RSA/classical ciphers) / encoding (XOR/Base64/UUID/MAC/IP/registry values/clipboard) |
| Cloud detection | - | Compile offline and strip debug info |
| Heuristic | Machine learning/YARA | Variable name obfuscation (pyob) / control-flow obfuscation / modify shellcode signatures with no effect (kill YARA with one byte in CS) |
| - | - | Serialization (Protobuf/Pickle) / treat shellcode as a string / staged loading (file/URL) |
Dynamic API loading:
Level 1: LoadLibrary + GetProcAddress
Level 2: fs→TEB→PEB→kernel32.dll→LoadLibrary+GetProcAddress
Level 3: SSN→Syscall
- SSN table: https://j00ru.vexillium.org/syscalls/nt/64/
- Tools: [SysWhispers3](https://github.com/klezVirus/SysWhispers3) / [HellBunny](https://github.com/voidvxwt/HellBunny)
In-memory loaders:
Allocate: VirtualProtect / VirtualAlloc / AllocADsMem / ReallocADsMem / HeapCreate
Write: RtlMoveMemory / RtlCopyMemory
Execute: EnumSystemLocalesA / CreateThread / WaitForSingleObject
Tools: [ZigStrike](https://github.com/0xsp-SRD/ZigStrike)
Function replacement: http://ropgadget.com/posts/abusing_win_functions.html
Execute inside the loader: easier to evade AV detection
Dynamic Detection vs Evasion
Anti-sandbox: boot time / physical memory / CPU count / number of Temp files / random string server check / USB records / sample name / disk size / internet reachability / named-pipe availability
Injection techniques:
| Technique | Description |
|------|------|
| Dynamic memory loading | inline hook sleep (custom sleep logic) / CreateTimerQueueTimer |
| Remote thread injection | CreateRemoteThread → OpenProcess+VirtualAllocEx+WriteProcessMemory |
| APC injection | APC + indirect syscall + module stomping / QueueUserApc / Early Bird |
| DLL hijacking | WinSxS DLL hijacking / Microsoft component hijacking (OneDrive) / DLL hijacking automation scripts |
| Callbacks | EnumChildWindows / AlternativeShellcodeExec |
| LLVM obfuscation | Arkari |
| Break process chains | Ring 3: ldte→InInitializationOrderModuleList / Ring 0: PsActiveProcessHead→Eprocess |
| Inject into other processes | unkillable loader |
| Kernel injection | Step Bear - EDR Storm-0978 |
Traffic Detection vs Evasion
| Detection dimension | What it detects |
|---|---|
| Traffic signatures | Fixed protocol encrypted fields (CS: RSA to pass AES key → AES-encrypted communication) |
| Content signatures | Encrypted command keywords in the data field |
| Structural signatures | Fixed field signatures |
| IP | C2 server IP |