admin/mgeeky-ShellcodeFluctuation
1
0
Fork 0
mirror of https://github.com/mgeeky/ShellcodeFluctuation synced 2026-06-06 16:14:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

readme

Browse Source
This commit is contained in:
Mariusz B. / mgeeky
2021-09-29 13:16:42 +02:00
parent 78e03dd146
commit 5df45957aa
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+4 -2
View File
@@ -73,16 +73,18 @@ Usage: ShellcodeFluctuation.exe <shellcode> <fluctuate>
1 - Inject shellcode and start fluctuating its memory.
```
### Moneta False Positive
### Moneta (seemingly) False Positive
So firstly we'll see what `Moneta64` scanner thinks about process that does nothing dodgy and simply resorts to run an infinite loop:
![moneta false positive](images/false-positive.png)
As we can see there's some **false positive** allegdly detecting `Mismatching PEB module` / `Phantom image`.
As we can see there's some **false positive** (at least how I consider it) allegdly detecting `Mismatching PEB module` / `Phantom image`.
The memory boundaries point at the `ShellcodeFluctuate.exe` module itself and could indicate that this module however being of `MEM_IMAGE` type, is not linked in process' PEB - which is unsual and sounds rather odd.
The reason for this IOC is not known to me and I didn't attempt to understand it better, yet it isn't something we should be concerned about really.
If anyone knows what's the reason for this detection, I'd be very curious to hear! Please do reach out.
### Not Encrypted Beacon
The second use case presents Memory IOCs of a Beacon operating within our process, which does not utilise any sorts of customised `Artifact Kits`, `User-Defined Reflective Loaders` (such as my [`ElusiveMice`](https://github.com/mgeeky/ElusiveMice)), neither any initial actions that would spoil our results.