[loomixx]

Hey guys. I’m new here. Recently I have coded my own botnet in c++. It was going pretty well until I faced a problem: what persistence method do i use, so it’s:
1) Undetected, legitimate-looking (like dll side loading into legitimate process)
2) User mode (no admin rights needed for dropper)
3) Works on windows 7, 8, 10, 11

I tried side loading into OneDrive (drop malicious botnet dll - cscapi.dll into %LOCALAPPDATA%\Microsoft\OneDrive, so when one drive launches, it loads malicious cscapi.dll instead of loading from system folder)
However, this works only on windows 10 because only there OneDrive is installed and is at autorun by default.

I don’t know if it is good idea to change botnet program from dll to exe, because obviously while exe-based persistence is simpler, it inherently carries a higher risk of detection, so it’s better to sideload (dll) into legitimate process.

So I'm eager to learn from the expertise within this community. Any insights into advanced persistence mechanisms that meet the above criteria would be invaluable.

Thank you for your time and consideration.

[AnonUserBB]

No admin privilege required, put the malware on "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" this should work.

Windows Defender is only going to detect it if the malware itself is bad obfuscated, not becouse its on "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"

[Goose Gladwell]

Some malware registers right before logoff/reboot/shutdown. (They don't register during startup). I thought this was worth pointing out.

[loomixx]

No admin privilege required, put the malware on "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" this should work.

Windows Defender is only going to detect it if the malware itself is bad obfuscated, not becouse its on "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"

thats so easy to detect

[holofernes]

Without admin privileges, you could create persistence by editing the registry of the current user profile:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

which can be done via CMD, powershell or with regedit. The downside to classic persistence of RAT tools is that Defender doesn't like new things added, especially unsigned programs. Depending on the scope of your project you might want to look into code signing or signature theft to prevent automated detection, especially if you go the route of making the program a .exe instead of a .dll.

[gangshitlol123]

task scheduler + some lolbin to hide powershell executing