From 6849c1bc02a3cc784f1c1fb631d00a1dc0006f97 Mon Sep 17 00:00:00 2001 From: "Mariusz B. / mgeeky" Date: Wed, 29 Sep 2021 15:33:16 +0200 Subject: [PATCH] readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 606b23f..64a3d01 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ After releasing [ThreadStackSpoofer](https://github.com/mgeeky/ThreadStackSpoofe Beforewards I was pretty sure the community already know how to encrypt/decrypt their payloads and flip their memory protections to simply evade memory scanners looking for anomalous executable regions. Questions proven otherwise so I decided to release this unweaponized PoC to document yet another evasion strategy and offer sample implementation for the community to work with. -This PoC is a demonstration of rather simple technique, already known to the offensive community (so I'm not bringin anything new here really) in hope to disclose secrecy behind magic showed by commercial frameworks such as [MDSec's Nighthawk C2](https://www.mdsec.co.uk/nighthawk/) that demonstrate their evasion capabilities targeting both aforementioned memory scanners. +This PoC is a demonstration of rather simple technique, already known to the offensive community (so I'm not bringin anything new here really) in hope to disclose secrecy behind magic showed by some commercial frameworks that demonstrate their evasion capabilities targeting both aforementioned memory scanners. **Here's a comparison:**