PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Malware development part 5 - tips & tricks

0xpat.github.io | blog | #red-team | #malware-development | #environmental-keying | #parent-pid-spoofing | #edr-evasion | #process-protection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Malware dev part 5: parent PID spoofing via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, process-hardening against EDR (ACG, Microsoft-only binaries), environmental keying and config brute-forcing.
Published
Collected

Related coverage

blog · 0xpat.github.io
Malware development part 9 - hosting CLR and managed code injection
Malware development part 9: executing managed .NET assemblies from native code—hosting the CLR via ICLRRuntimeHost/ICorRuntimeHost, and running payloads from memory rather than disk.
blog · 0xpat.github.io
Malware development part 8 - COFF injection and in-memory execution
Part 8 of the malware dev series: a COFF object-file loader à la Cobalt Strike's BOFs—compiling C to .obj, parsing headers, sections and relocations, then executing the machine code from memory.
blog · 0xpat.github.io
Malware development part 7 - Secure Desktop keylogger
Part 7 of the malware dev series builds a Secure Desktop keylogger: after escalating to SYSTEM, a low-level keyboard hook on the WINLOGON desktop captures credentials typed into UAC and logon prompts.
blog · 0xpat.github.io
Malware development part 6 - advanced obfuscation with LLVM and template metaprogramming
Malware development part 6: anti-disassembly obfuscation with Obfuscator-LLVM—how IR-level transforms and template metaprogramming hide control flow, plus the VS2017 build setup.
blog · 0xpat.github.io
Malware development part 4 - anti static analysis tricks
Malware dev part 4: Visual Studio compiler and linker settings as evasion—custom msvcrt.lib builds that shrink payloads to ~4 KB, optimization flags, and obfuscation for static-analysis resistance.
blog · 0xpat.github.io
Malware development part 3 - anti-debugging
Part 3 of the malware dev series: detecting debuggers via IsDebuggerPresent, PEB flags, NtQueryInformationProcess artifacts and breakpoint checks—plus tricks to hinder manual analysis.
Back