Introduction This is the 9th post of a series which regards the development of malicious software. In this series we will explore and try to implement multiple techniques used by malicious applications to execute code, hide from defenses and persist. Today we explore techniques for executing managed code from a native code.

Cyber security, Red Teaming and CTF Writeup’s

📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help

Here is a scenario you probably have never encountered. Have you ever decompiled a .NET binary that only consists of a bunch of await keywords and nothing else?

Over the past couple years, I have come to know the .NET platform pretty well, from both a developer’s and a reverse engineer’s standpoint.

In this post we will focus on Event Threading for Windows (ETW), how it is used to surface events on .NET assemblies, and how we can evade this kind of detection.

Good CLR Host with Native patchless AMSI Bypass. Contribute to almounah/go-buena-clr development by creating an account on GitHub.

Ghosting-AMSI . Contribute to andreisss/Ghosting-AMSI development by creating an account on GitHub.

NukeAMSI is a powerful tool designed to neutralize the Antimalware Scan Interface (AMSI) in Windows environments. - anonymous300502/Nuke-AMSI

A PoC .NET-specific process injection tool. Contribute to bananabr/CLRInjector development by creating an account on GitHub.

The Boo Programming Language. Contribute to boo-lang/boo development by creating an account on GitHub.

The Boo Programming Language. Contribute to boo-lang/boo development by creating an account on GitHub.

DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries. - DylanDavis1/DSCourier

Cobalt Strike BOF for evasive .NET assembly execution - EricEsquivel/Inline-EA

A C# PE loader for x64 and x86 PE files. Contribute to iss4cf0ng/dotNetPELoader development by creating an account on GitHub.

The best powershell obfuscator ever made. Contribute to KingKDot/PowerCrypt development by creating an account on GitHub.

Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques - MHaggis/NEBULA

Evasive loader for .NET Framework assemblies. Contribute to Mister-Joe/PositiveIntent development by creating an account on GitHub.

A proof of concept AMSI & ETW bypass using trampolines for hooking and modifying execution flow - GitHub - mochabyte0x/TrampoLatte: A proof of concept AMSI & ETW bypass using trampolines for hooking and modifying execution flow

Run native PE or .NET executables entirely in-memory. Build the loader as an .exe or .dll—DllMain is Cobalt Strike UDRL-compatible - NtDallas/MemLoader

Contribute to passthehashbrowns/Being-A-Good-CLR-Host development by creating an account on GitHub.

A set of scripts that demonstrate how to perform memory injection in C# - pwndizzle/c-sharp-memory-injection

Powershell wrap of NetLoader. Contribute to raskolnikov90/Invoke-NetLoader development by creating an account on GitHub.

Custom Amsi Bypass by patching AmsiOpenSession function in amsi.dll - raskolnikov90/LainAmsiOpenSession

This repo contains some Amsi Bypass methods i found on different Blog Posts. - S3cur3Th1sSh1t/Amsi-Bypass-Powershell

This repo contains some Amsi Bypass methods i found on different Blog Posts. - S3cur3Th1sSh1t/Amsi-Bypass-Powershell

A PowerShell console in C/C++ with all the security features disabled - scrt/PowerChell

A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage PowerShell reverse shell. - Sh3lldon/FullBypass

C# implementation of the process injection techniques dubbed "PoolParty" - strozfriedberg/SharpParty

Invoke-SPSI - Simple PowerShell Shellcode Injector - t1Sh1n4/Invoke-SPSI

A list of useful Powershell scripts with 100% AV bypass (At the time of publication). - GitHub - tihanyin/PSSW100AVB: A list of useful Powershell scripts with 100% AV bypass (At the time of publication).

🔥📜 Forbidden collection of Red Team sorcery 📜🔥. Contribute to vari-sh/RedTeamGrimoire development by creating an account on GitHub.

🔥📜 Forbidden collection of Red Team sorcery 📜🔥. Contribute to vari-sh/RedTeamGrimoire development by creating an account on GitHub.

A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, function hooking or Import Address Table (IAT) modification. - vxCrypt0r/AMSI_VEH

.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries. - Zypherion-Technologies/Nemesis

GitLab.com

TL;DR For people that just want the slides and github link

Learn how red teams can modernize their use of .NET assemblies using CLR customizations.

In my previous post “Red Team Tactics: Utilizing Syscalls in C# - Prerequisite Knowledge”, we covered some basic prerequisite concepts that we needed to understand before we could utilize syscalls in C#. We touched on some in-depth topics like windows internals and of course syscalls. We also went over how the .NET Framework functions and how we can utilize unmanaged code in C# to execute our syscall assemblies.

Refining Detection: New Perspectives on ETW Patching Telemetry Introduction Not long ago I wrote a blog called Understanding ETW Patching where I walked through how ETW patching is a hyper-focused …

Understanding ETW Patching Introduction As of late, I have gotten a lot of questions around Event Tracing for Windows (ETW) patching, specifically the following questions: Which ETW providers can be …

This blog post introduces an addition to the red teamers’ toolkit called “SharpParty” – a C# implementation of the injection techniques dubbed “PoolParty”.

Ghosting AMSI: Cutting RPC to disarm AV In this post, we explore how to bypass AMSI’s scanning logic by hijacking the RPC layer it depends on — specifically the NdrClientCall3 stub used to invoke …

AMSI BYPASS WITHOUT AMSI BYPASS !? Introduction In this blog, we — Itay Yashar and Omer Golan outline a highly stealthy technique that prevents amsi.dll from being loaded into a process when …

19 September 2022

On Windows 11 24H2, Constrained Language Mode is no longer enforced correctly when using AppLocker Script Enforcement Rules

WasmForge compiles GhostPack C# tools to WebAssembly. Surface how Rubeus and Seatbelt run past your AMSI and ETW defenses, signature-free.

This blog post will give a short overview of how in-memory .NET assembly execution commonly works and what detection mechanisms exist.

Latest Research by our Team

This is my very first blog post. Its about how to manually change AMSI signatures/triggers to bypass it.

In the last months I was often asked about potential errors using PowerSharpPack or other PS1-scripts loading .NET assemblies via [System.Reflection.Assembly...

This post cover how PowerShell becomes a main tool in offensive operations starting with the weaponization, delivery, attak-chain and post-exploitation.

TLDR: Version v1.0 “Cruller” of Donut has been released, including Module Overloading for native PEs, ETW bypasses, a Dockerfile, support for binaries without relocation information, and many other minor improvements and bugfixes.

TLDR: Presenting DInvoke, a new API in SharpSploit that acts as a dynamic replacement for PInvoke. Using it, we show how to dynamically invoke unmanaged code from memory or disk while avoiding API Hooking and suspicious imports.

TLDR: You can now inject .NET Assemblies into Windows processes using this repo: https://github.com/TheWover/donut/

TLDR: One of the ways to load .NET Assemblies through unmanaged code is to use C++/CLI. What is that, you may ask? It is Visual C++ that can be compiled to CIL rather than native machine code. You may specify that code is either managed or native. Native code is written the same as normal C++. The managed version, however, uses a different syntax. To compile managed C++, you must use the /clr option on the Visual Studios compiler. This repo provides some code samples that demonstrate how to do this. Warning, the code is a bit wonky. That is partly because I’ve never gotten around to cleaning it up and also because this is just meant to make you aware that C++/CLI is a thing.

AMSI is the Microsoft anti-malware barrier that every modern user-mode loader has to deal with. Patching it is loud — every defender knows the byte signature. This post walks through a patchless bypass using x86 hardware debug registers + a vectored exception handler. Validated against a contemporary commercial EDR in a licensed lab. Implementation, stack mechanics, and detection avenues.

Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity. This post demonstrates how command-line obfuscation, a shell-independent technique that exploits executables’ parsing “flaws”, can bypass such detections. It also introduces ArgFuscator, a new tool that documents obfuscation opportunities and generates obfuscated command lines.