Incodenito
Incodenito
  • 16
  • 31 095
Blocking Process Injection With My Custom EDR
Evasion Games: evasiongames.org
Welcome to the building an EDR from scratch series! In this series were going to work through the different components of an EDR building them one by one.
This video focuses on the hooking DLL using hooks to stop process injection in its tracks. We build out a few different protections in this video. If you can think of any ways to evade these protections let me know in the comments or in discord!
Let me know your thoughts and thank you for taking the time to watch the series!!
Don't forget to check out evasiongames.org if you're hyped on trying to evade EDR yourself!
Here is a link to the project in this video: github.com/ytincodenito/vEDR
GitHub: github.com/ytincodenito
Discord: discord.gg/S9VqgsEx9r
Переглядів: 218

Відео

Building an EDR From Scratch Part 4 - Kernel Driver (Endpoint Detection and Response)1:32:17Building an EDR From Scratch Part 4 - Kernel Driver (Endpoint Detection and Response)
Building an EDR From Scratch Part 4 - Kernel Driver (Endpoint Detection and Response)
Переглядів 839Місяць тому
Evasion Games: evasiongames.org Welcome to part 4 the building an EDR from scratch series! In this series were going to work through the different components of an EDR building them one by one. This video is focused on building out the first pieces of our kernel driver. We create callback functions, register a call back, and create a system for injecting our DLL into processes on the system. Le...
Building an EDR From Scratch Part 3 - Creating The Agent (Endpoint Detection and Response)34:06Building an EDR From Scratch Part 3 - Creating The Agent (Endpoint Detection and Response)
Building an EDR From Scratch Part 3 - Creating The Agent (Endpoint Detection and Response)
Переглядів 806Місяць тому
Evasion Games: evasiongames.org Welcome to part 3 the building an EDR from scratch series! In this series were going to work through the different components of an EDR building them one by one. This video was primarily focused on creating the initial agent and a communication path from the hooking DLL to the agent. The structure developed in this video will be the foundation of the agent logic ...
Building an EDR From Scratch Part 2 - Hooking DLL (Endpoint Detection and Response)39:46Building an EDR From Scratch Part 2 - Hooking DLL (Endpoint Detection and Response)
Building an EDR From Scratch Part 2 - Hooking DLL (Endpoint Detection and Response)
Переглядів 1,4 тис.Місяць тому
Evasion Games: evasiongames.org Welcome back to the building an EDR from scratch series! In this series were going to work through the different components of an EDR building them one by one. The focus of this video was on building out an MVP (minimum viable product) of the hooking DLLcomponent. This component will get use started on our EDR journey! let me know your thoughts on the content, it...
Building an EDR From Scratch Part 1 - Intro (Endpoint Detection and Response)2:13Building an EDR From Scratch Part 1 - Intro (Endpoint Detection and Response)
Building an EDR From Scratch Part 1 - Intro (Endpoint Detection and Response)
Переглядів 2,3 тис.2 місяці тому
Welcome to the new EDR from scratch series! In this series were going to work through the different components of an EDR building them one by one. We will start out with the very basic skeleton and build out some detection and preventions over the course of the series. At the end of the series ill have a special announcement for what were going to do with the EDR so make sure you subscribe and ...
INDIRECT Systems Calls For Hackers12:16INDIRECT Systems Calls For Hackers
INDIRECT Systems Calls For Hackers
Переглядів 6722 місяці тому
In our final video of the syscalls series we make a final upgrade to our syscall application where we change our syscall to use the syscall instruction inside of NTDLL. This makes our syscall example even more stealthy! Don't forget to like, share, and subscribe for more content on malware development and cybersecurity. Let's dive deep into the world of malicious code together! Code from the vi...
Direct System Calls For Hackers (EDR Evasion)14:20Direct System Calls For Hackers (EDR Evasion)
Direct System Calls For Hackers (EDR Evasion)
Переглядів 1,3 тис.2 місяці тому
In this video we take the systemcalls code we wrote in the last video and we upgrade it to use direct systems calls. Then we review the applicatio n and show how the direct system calls can help to avoid usermode hooking by debugging and hooking our new application. Don't forget to like, share, and subscribe for more content on malware development and cybersecurity. Let's dive deep into the wor...
System Calls For Hackers25:20System Calls For Hackers
System Calls For Hackers
Переглядів 1,4 тис.3 місяці тому
In this video I explain the basics of Windows systems calls and why you might be interested in them as a malware devloper. I then take us to the IDE and write some code. The code consists of a regular windows function call and a system call to show the difference. finally we dig into the application and the difference in of the function calls using API monitor and x64dbg. Thanks for stopping by...
Malware Development: Thread HiJacking9:21Malware Development: Thread HiJacking
Malware Development: Thread HiJacking
Переглядів 8843 місяці тому
In this video I go over the basics of thread hijacking and why it might be used in malware development. I then write a POC along with you and show you what it looks like when executing. Discord: discord.gg/S9VqgsEx9r Code from the video found at: github.com/ytincodenito/ThreadHijacking Github: github.com/ytincodenito Disclaimer: The content in this video is for educational purposes only and not...
How to BYPASS ANTIVIRUS with WEB-BASED PAYLOAD STAGING10:40How to BYPASS ANTIVIRUS with WEB-BASED PAYLOAD STAGING
How to BYPASS ANTIVIRUS with WEB-BASED PAYLOAD STAGING
Переглядів 1,8 тис.8 місяців тому
In this video, we're diving into web-based payload staging with a focus on shellcode. I'll show you how to use a Python HTTP server to stage our shellcode, making it ready for action. Then, downloading and injecting it with C . Web-based staging has its perks, like making it harder for defenses to spot what's happening, thanks to the commonality of web traffic. And when it comes to shellcode, i...
How to use IPv4 to BYPASS ANY ANTIVIRUS SIGNATURE BASED DETECTION17:10How to use IPv4 to BYPASS ANY ANTIVIRUS SIGNATURE BASED DETECTION
How to use IPv4 to BYPASS ANY ANTIVIRUS SIGNATURE BASED DETECTION
Переглядів 1,9 тис.8 місяців тому
In this UA-cam video I explain a straightforward technique for bypassing signature-based antivirus detection. The focus is on converting shellcode into IPv4 addresses, a method that can help in evading detection. I provide a practical demonstration to show exactly how this bypass works. This video is aimed at those interested in cybersecurity concepts, particularly in understanding how certain ...
How to LEARN WINDOWS API (for hacking windows)44:49How to LEARN WINDOWS API (for hacking windows)
How to LEARN WINDOWS API (for hacking windows)
Переглядів 2,3 тис.8 місяців тому
In this UA-cam tutorial, 'How to LEARN WINDOWS API (for hacking windows),' we cover the essentials of using the Windows API for programming, with a focus on hacking Windows. The video starts with an introduction to the basic data types you'll encounter in Windows API. Then, we take a closer look at how to navigate and use the API documentation effectively. Finally, we wrap up by walking you thr...
Deep Dive into DLL Sideloading and DLL Hijacking - Malware Development Course38:41Deep Dive into DLL Sideloading and DLL Hijacking - Malware Development Course
Deep Dive into DLL Sideloading and DLL Hijacking - Malware Development Course
Переглядів 5 тис.9 місяців тому
In this video, we will be taking a deep dive into the concepts of DLL Sideloading and DLL Hijacking. DLL Sideloading involves loading malicious code through a legitimate application, making it difficult for traditional security measures to detect. On the other hand, DLL Hijacking exploits the search path used by Windows to locate DLLs, allowing attackers to replace legitimate DLLs with maliciou...
Getting Started with C++ for Malware Development and Cyber Security12:00Getting Started with C++ for Malware Development and Cyber Security
Getting Started with C++ for Malware Development and Cyber Security
Переглядів 8659 місяців тому
Whether you are interested in learning the basics of C for developing malware or to strengthen your skills in cyber security, this tutorial will help you get your develoment environment set up for our upcoming series! Dont forget to submit your challenge entry to the discord channel! Discord: discord.gg/S9VqgsEx9r Github: github.com/ytincodenito
Malware Development Course: Process Injection Part 2 (Shellcode)33:43Malware Development Course: Process Injection Part 2 (Shellcode)
Malware Development Course: Process Injection Part 2 (Shellcode)
Переглядів 1,2 тис.9 місяців тому
In part 2 of the malware development series we take a look at shellcode and shellcode injection! We start off with a short description of what shellcode is and why it's even used. Then we develop 2 full shellcode injection malware components. Code from the video found at: github.com/ytincodenito/easy_process_injection Discord: discord.gg/S9VqgsEx9r Github: github.com/ytincodenito Disclaimer: Th...
Malware Development Course: Process Injection Part 1 (DLL's)27:22Malware Development Course: Process Injection Part 1 (DLL's)
Malware Development Course: Process Injection Part 1 (DLL's)
Переглядів 8 тис.9 місяців тому
Malware Development Course: Process Injection Part 1 (DLL's)