This project consists of a simple C++ self-Injecting dropper focused on EDR evasion POC. To implement it, I have combined the use of Windows Thread Pooling to hide the call stack and the use of indirect syscalls to avoid hooking in the NTDLL.
As can be seen in the images, from the Cordyceps code, it performs a jump to ntdll to utilize one of the syscall instructions. This should be considered a malicious action; however, upon executing the return in ntdll, we return to the code of tpWorker, which is located within ntdll. Thus, from the perspective of the antivirus (AV), ntdll would appear to be making a call to another part of ntdll, which is not considered malicious.
nasm -f win64 ./syscalls.asm -o ./syscalls.obj
g++ -o cordyceps.exe main.cpp syscalls.objKnowing how to Check Ubuntu Version details is essential for system administration, troubleshooting, and software…
Managing a Linux server becomes much safer when you Create Sudo User accounts instead of…
Managing software on Linux becomes much easier when you know how to List Installed Packages…
Introduction Variables are one of the most important basics of Bash scripting. A variable is…
Introduction Running a Bash script in Linux is a basic but important skill for anyone…
Introduction Writing your first Bash script in Linux is one of the best ways to…