+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Persistance Defender Detections (/showthread.php?tid=6212831)
Persistance Defender Detections - squidward1337 - Jul 10, 2022
Hello,
Im currently writing a crypter in c#.
It is FUD by now in 99% of the crypts.
But my persistance method is detected as Trojan by Defender: Win32/Bearfoos.B!ml or Behavior:Win32/Persistence.A!ml.
If i don't include persistance it is fud.
Im dropping a Powershell script which is copying the .exe into a folder and adds an entry to Run Registry KEY and than deletes itself.
During runtime it is undetected and executes.
But Defender later catches it with both detections above and also catches the copied file as soon as a restart is done.
Does anyone know a good persistance method (that does NOT require admin)?
Or someone knows what I can do to prevent these detections?
Harmless programms also add themselfes to Run Key so I dont understand why it is detected.
Dropping to Startup folder has same detections btw.
Thanks for help
RE: Persistance Defender Detections - Frost Crypt - Jul 10, 2022
why are you dropping the powershell script, you could execute powershell commands directly from c# without any drop including your registry key.
That could be the reason of the detection.
RE: Persistance Defender Detections - squidward1337 - Jul 10, 2022
(Jul 10, 2022 10:00 AM)Nano Shield Wrote: why are you dropping the powershell script, you could execute powershell commands directly from c# without any drop including your registry key.
That could be the reason of the detection.
First i did not and executed everything in Executable. Tryed it with PS Scripts to have another process execute the persistance to avoid having Assembly.Load and Persistence in the same file. Thought that could be the cause of the detection. So same result with doing it in executable.
Thanks shatter. This may help!
RE: Persistance Defender Detections - 【ＢＡＤＭＡＮ】 - Jul 11, 2022
(Jul 10, 2022 10:06 AM)shatter Wrote: https://github.com/mandiant/SharPersist
Most of these require admin , also they are detected.
I have seen lot of persistence methods recently which also require admin but they are probably not detected by wd (havent tested all of them).
What i personally use is some variant of dll proxy load for programs that already use startup.
RE: Persistance Defender Detections - 【ＢＡＤＭＡＮ】 - Jul 11, 2022
(Jul 11, 2022 03:57 PM)shatter Wrote: here's an idea
execute in memory!
It doesnt matter, you will get flagged after system reboot even if success to pass your file to startup at first execution.
Task scheduler , Registries and Services are monitored.