PE 7 - Unhook NTDLL.DLL (Lagos Island)
- In this lab, we cover a Reflective DLL Loading technique. This technique to manually load and execute a DLL from disk into memory, often referred to as reflective DLL loading. This is useful in scenarios where loading a DLL without registering it in the process's module list is required, a common tactic in malware evasion and advanced threat emulation. The code manually maps the sections of the DLL into memory, resolves imports and exports, and executes shellcode through NtCreateThreadEx, avoiding standard Windows loader mechanisms.
+In this lab, we cover a Reflective DLL Loading technique. This technique to manually load and execute a DLL from disk into memory, often referred to as reflective DLL loading. This is useful in scenarios where loading a DLL without registering it in the process's module list is required, a common tactic in malware evasion and advanced threat emulation.
PE 8 -Process Hollowing
@@ -260,14 +265,14 @@ layout: defaultPE 12 - Early Bird Injection
- In this lab, we cover EarlyBird Injection technique, EarlyBird Injection is a process injection technique used to inject code into a target process early in its lifecycle, often before the process has fully initialized. This technique exploits the fact that the process is in a suspended state, allowing for more control and less detection. EarlyBird Injection allows you to inject code at a much earlier stage compared to APC (Asynchronous Procedure Call) injection, which typically occurs when the thread is running.
+In this lab, we cover EarlyBird Injection technique, EarlyBird Injection is a process injection technique used to inject code into a target process early in its lifecycle, often before the process has fully initialized. This technique exploits the fact that the process is in a suspended state, allowing for more control and less detection. EarlyBird Injection allows you to inject code at a much earlier stage compared to APC injection.
PE 13 - RWX Hunting Injection
- In this lab, we cover RWX hunting technique to avoid RWX memory detection of AV/EDR solutions, RWX hunt technique involves locating a target process, identifying writable and executable memory regions within that process, injecting shellcode into the identified memory, and then executing the shellcode. It starts by enumerating processes to find the target by name using functions like NtGetNextProcess and GetProcessImageFileNameA. Once the target process is identified, the code examines its memory regions with VirtualQueryEx to find suitable locations for code injection.
+In this lab, we cover RWX hunting technique to avoid RWX memory detection of AV/EDR solutions, RWX hunt technique involves locating a target process, identifying writable and executable memory regions within that process, injecting shellcode into the identified memory, and then executing the shellcode.
@@ -286,7 +291,7 @@ layout: defaultPE 16 - Remote Thread Hijacking
- In this lab, we cover Remote Thread Hijacking technique, Remote Thread Hijacking is a method of injecting code into a process by hijacking an existing thread in that process. Unlike traditional code injection methods (e.g., using CreateRemoteThread or NtCreateThreadEx), this technique manipulates an already-running thread to execute malicious payloads. This makes detection harder, as no new thread creation events are logged, and it avoids common anti-malware defenses that monitor thread creation.
+In this lab, we cover Remote Thread Hijacking technique, Remote Thread Hijacking is a method of injecting code into a process by hijacking an existing thread in that process. Unlike traditional code injection methods (e.g., using CreateRemoteThread or NtCreateThreadEx), this technique manipulates an already-running thread to execute malicious payloads.
@@ -300,14 +305,14 @@ layout: defaultPE 18 - PEB Walk and Obfuscation Technique
- In this lab, we cover PEB Walk and API Obfuscation Injection, By using the PEB, the code directly traverses the list of loaded modules to find kernel32.dll, bypassing static analysis methods that rely on import table inspection. Once kernel32.dll is identified, the technique resolves necessary API functions such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread dynamically at runtime. This time we are obfuscating all the APIs to avoid string based detection and make it difficult to understand the working of exploit in static analysis.
+In this lab, we cover PEB Walk and API Obfuscation Injection, By using the PEB, the code directly traverses the list of loaded modules to find kernel32.dll, bypassing static analysis methods that rely on import table inspection. Once kernel32.dll is identified, the technique resolves necessary API functions such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread dynamically at runtime.
PE 19 - NtCreateThread and Map View
- In this lab, we cover NtCreateSection and NtMapViewOfSection code Injection, This code injection technique utilizing Native APIs such as NtCreateSection, NtMapViewOfSection, and RtlCreateUserThread. The process begins by creating a new memory section with read, write, and execute (RWX) protection using NtCreateSection. Subsequently, a view of this section is mapped into the local malicious process with read and write (RW) protection. Simultaneously, the same section is mapped into the target process with read and execute (RX) protection. This strategy avoids the need to allocate memory pages with RWX protection, which might be flagged by some endpoint detection and response (EDR) systems.
+In this lab, we cover NtCreateSection and NtMapViewOfSection code Injection, This code injection technique utilizing Native APIs such as NtCreateSection, NtMapViewOfSection. The process begins by creating a new memory section with read, write, and execute (RWX) protection using NtCreateSection.