readme

2026-06-06 16:14:31 +00:00 · 2021-09-29 12:41:51 +02:00
parent 60c9c40a79
commit 693a640e0d
2 changed files with 8 additions and 0 deletions
@@ -15,6 +15,14 @@ Questions proven otherwise so I decided to release this unweaponized PoC to docu
 This PoC is a demonstration of rather simple technique, already known to the offensive community (so I'm not bringin anything new here really) in hope to disclose secrecy behind magic showed by commercial frameworks such as [MDSec's Nighthawk C2](https://www.mdsec.co.uk/nighthawk/) that demonstrate their evasion capabilities targeting both aforementioned memory scanners.


+Here's a comparison:
+
+1. Beacon not encrypted
+2. Beacon encrypted
+
+![comparison](images/comparison.png)
+
+
 ## How it works?

 This program performs self-injection shellcode (roughly via classic `VirtualAlloc` + `memcpy` + `CreateThread`).