This project consists of a simple C++ self-Injecting dropper focused on EDR evasion POC. To implement it, I have combined the use of Windows Thread Pooling to hide the call stack and the use of indirect syscalls to avoid hooking in the NTDLL.
As can be seen in the images, from the Cordyceps code, it performs a jump to ntdll to utilize one of the syscall instructions. This should be considered a malicious action; however, upon executing the return in ntdll, we return to the code of tpWorker, which is located within ntdll. Thus, from the perspective of the antivirus (AV), ntdll would appear to be making a call to another part of ntdll, which is not considered malicious.
nasm -f win64 ./syscalls.asm -o ./syscalls.obj
g++ -o cordyceps.exe main.cpp syscalls.objThe jobs command is a Bash builtin that lists all background and suspended processes belonging to the…
The Linux kernel writes messages to the kernel ring buffer throughout the boot process and…
rsync over SSH combines secure encrypted transport with fast incremental transfers. Instead of copying every file…
The pstree command in Linux displays running processes in a tree structure rather than a flat list.…
The type command in Linux shows how the current shell would interpret a name typed on the…
When a Linux system is slow or behaving unexpectedly, memory is one of the first…