diff --git a/README.md b/README.md index db99069..606b23f 100644 --- a/README.md +++ b/README.md @@ -75,6 +75,10 @@ Usage: ShellcodeFluctuation.exe ### Moneta (seemingly) False Positive +``` +C:\> ShellcodeFluctuation.exe beacon64.bin -1 +``` + So firstly we'll see what `Moneta64` scanner thinks about process that does nothing dodgy and simply resorts to run an infinite loop: ![moneta false positive](images/false-positive.png) @@ -87,6 +91,10 @@ If anyone knows what's the reason for this detection, I'd be very curious to hea ### Not Encrypted Beacon +``` +C:\> ShellcodeFluctuation.exe beacon64.bin 0 +``` + The second use case presents Memory IOCs of a Beacon operating within our process, which does not utilise any sorts of customised `Artifact Kits`, `User-Defined Reflective Loaders` (such as my [`ElusiveMice`](https://github.com/mgeeky/ElusiveMice)), neither any initial actions that would spoil our results. ![moneta not encrypted](images/not-encrypted.png) @@ -96,6 +104,10 @@ That's really strong Memory IOC exposing our shellcode for getting dumped and an ### Encrypted Beacon +``` +C:\> ShellcodeFluctuation.exe beacon64.bin 1 +``` + Now the third, most interesting from perspective of this implementation, use case being _fluctuating_ Beacon. ![moneta encrypted](images/encrypted.png)