admin/thefLink-DeepSleep
1
0
Fork 0
mirror of https://github.com/thefLink/DeepSleep synced 2026-06-06 16:54:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
thefLink
2022-05-25 00:23:52 +02:00
committed by GitHub
parent 0ae428a28b
commit 2d0c6b684d
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -45,7 +45,7 @@ It is probably a good idea to make use of smaller and more generic ROPgadgets an
## Detection
The callstack to a thread in the ```DelayExecution``` state includes unknown/tampered memory regions and additionally includes addresses to VirtualProtect()
The callstack to a thread in the ```DelayExecution``` state includes unknown/tampered memory regions and additionally includes addresses to VirtualProtect(). [Hunt-Sleeping-Beacons](https://github.com/thefLink/Hunt-Sleeping-Beacons) detects this.
It may be possible to apply that metric to other C2 using a different technique to Sleep.
![Weird Stack](/Screens/WeirdTrace.png?raw=true "Weird Trace")