มึงบอกลา EDR/AV แบบเก่าได้เลย ตัวนี้เทคนิคโหดกว่าสัสเลยล่ะ
SilentisVox/SyscallRevenant
1 like · 140 views
#tools
#Offensive_security
SyscallRevenant: Surpassing EDRs & AVs
SilentisVox/SyscallRevenant
// new method of performing clean indirect syscalls. The main component resolves System Service Numbers and syscall instruction addresses dynamically. This is done by enabling the trap flag during execution. The secondary component is tampering via parameter replacement before a syscall. This combination is designed to bypass userland hooks during the subsequent syscall invocation while substituting the initially presented parameters. cyberpocket.org
96 views
SyscallRevenant - a new method of performing clean indirect syscalls. The main component resolves System Service Numbers (SSNs) and syscall instruction addresses dynamically
SilentisVox/SyscallRevenant
39 likes · 7 reposts · 1,335 views
Detection Gaps with Indirect Syscalls and Parameter Tampering
Indirect Syscalls, Return Address Spoofing, and Parameter Tampering
Detection Gaps with Indirect Syscalls and Parameter Tampering
What would you look for to catch this? Would the tracing or call stack give it away, or would you focus on what the syscall actually does?
I’d be interested to hear where you think this falls apart and how you’d test it.
3 points
Indirect Syscalls, Return Address Spoofing, and Parameter Tampering
Is there a way to stop this outside of QPC timestamps?
2 points · 2 comments
Mentions
มึงบอกลา EDR/AV แบบเก่าได้เลย ตัวนี้เทคนิคโหดกว่าสัสเลยล่ะ SilentisVox/SyscallRevenant
#tools #Offensive_security SyscallRevenant: Surpassing EDRs & AVs SilentisVox/SyscallRevenant // new method of performing clean indirect syscalls. The main component resolves System Service Numbers and syscall instruction addresses dynamically. This is done by enabling the trap flag during execution. The secondary component is tampering via parameter replacement before a syscall. This combination is designed to bypass userland hooks during the subsequent syscall invocation while substituting the initially presented parameters. cyberpocket.org
SyscallRevenant - a new method of performing clean indirect syscalls. The main component resolves System Service Numbers (SSNs) and syscall instruction addresses dynamically SilentisVox/SyscallRevenant
Detection Gaps with Indirect Syscalls and Parameter Tampering
Indirect Syscalls, Return Address Spoofing, and Parameter Tampering
Detection Gaps with Indirect Syscalls and Parameter Tampering What would you look for to catch this? Would the tracing or call stack give it away, or would you focus on what the syscall actually does? I’d be interested to hear where you think this falls apart and how you’d test it.
Indirect Syscalls, Return Address Spoofing, and Parameter Tampering Is there a way to stop this outside of QPC timestamps?