Anti-Virus

Masquerading Windows processes like a DoubleAgent.

23 April 2020 ~13 min By Philippe Vogler
Anti-Virus Malware Persistence Post-Exploitation Sysmon Windows
I’ve been spending some time building new content for our Introduction to Red Teaming course, which has been great for diving into AV/EDR bypass techniques again. In this blog post, I will demonstrate how to re-weaponise the old “DoubleAgent” technique, making endpoint security products do the hacking work for us. One known vector to shimmy past AV solutions is to use process injections. At BlackHat 2019, a number of process…

Kwetza: Infecting Android Applications

03 October 2016 ~9 min By chris
Android Anti-Virus Howto Research Tools
This blog post describes a method for backdooring Android executables. After describing the manual step, I will show how to do the same with a new tool, Kwetza, that I’m releasing today. Infecting Android applications provides a great way to determine the impact and affect of the malicious activities we see in the wild, from ransomware to practical jokes. This not only provides you with an entry point onto user devices,…