From edf2cc83162e232a3e5d51bca489d539b676f370 Mon Sep 17 00:00:00 2001 From: "Mariusz B. / mgeeky" Date: Wed, 29 Sep 2021 13:17:26 +0200 Subject: [PATCH] readme --- README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/README.md b/README.md index db99069..606b23f 100644 --- a/README.md +++ b/README.md @@ -75,6 +75,10 @@ Usage: ShellcodeFluctuation.exe ### Moneta (seemingly) False Positive +``` +C:\> ShellcodeFluctuation.exe beacon64.bin -1 +``` + So firstly we'll see what `Moneta64` scanner thinks about process that does nothing dodgy and simply resorts to run an infinite loop: ![moneta false positive](images/false-positive.png) @@ -87,6 +91,10 @@ If anyone knows what's the reason for this detection, I'd be very curious to hea ### Not Encrypted Beacon +``` +C:\> ShellcodeFluctuation.exe beacon64.bin 0 +``` + The second use case presents Memory IOCs of a Beacon operating within our process, which does not utilise any sorts of customised `Artifact Kits`, `User-Defined Reflective Loaders` (such as my [`ElusiveMice`](https://github.com/mgeeky/ElusiveMice)), neither any initial actions that would spoil our results. ![moneta not encrypted](images/not-encrypted.png) @@ -96,6 +104,10 @@ That's really strong Memory IOC exposing our shellcode for getting dumped and an ### Encrypted Beacon +``` +C:\> ShellcodeFluctuation.exe beacon64.bin 1 +``` + Now the third, most interesting from perspective of this implementation, use case being _fluctuating_ Beacon. ![moneta encrypted](images/encrypted.png)