admin/boku7-Loki
1
0
Fork 0
mirror of https://github.com/boku7/Loki synced 2026-06-06 15:24:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update recommendations.md

Browse Source
This commit is contained in:
Bobby Cooke
2025-04-03 20:06:40 -07:00
committed by GitHub
parent c2b28b5c8b
commit 6bc1328df5
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/opsec/recommendations.md
+1 -1
View File
@@ -4,6 +4,6 @@
- Use Node tools to package everything into an ASAR archive
- Replace strings in `agent/packages.json` to match target Electron app
- Recompile the node DLLs or modify them to change their hash
- The assembly execution out of the box node DLL will get you burned against MDE. It is ported code from Shawn Jones public bersion of Inline-ExecuteAssembly. Recently MDE rolled out a detection for patching the AMSI function, which results in a HIGH threat detection thrown.
- The assembly execution out of the box node DLL will get you burned against MDE. It is ported code from Shawn Jones public version of Inline-ExecuteAssembly. Recently MDE rolled out a detection for patching the AMSI function, which results in a HIGH threat detection thrown.
- Make changes to the assembly execution C++ code to use a viable AMSI and ETW bypass method, or comment out the patches, and compile yourself.
- At runtime the Electron app will create a directory in ~/AppData/Roaming/ with whatever name you put in the agents pckages.json at the top. Probably want to use an app name that is not suspicious, and not "Loki C2".