admin/thefLink-DeepSleep
1
0
Fork 0
mirror of https://github.com/thefLink/DeepSleep synced 2026-06-06 16:54:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
thefLink
2022-05-25 00:40:18 +02:00
committed by GitHub
parent 56d3e447d9
commit cab222111f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -46,7 +46,7 @@ It is probably a good idea to make use of smaller and more generic ROPgadgets an
## Detection
The callstack to a thread in the ```DelayExecution``` state includes unknown/tampered memory regions and additionally includes addresses to VirtualProtect(). [Hunt-Sleeping-Beacons](https://github.com/thefLink/Hunt-Sleeping-Beacons) detects this.
It may be possible to apply that metric to other C2 using a different technique to Sleep.
It may be possible to apply that metric to other C2 using a different technique to wait between callbacks.
![Weird Stack](/Screens/WeirdTrace.png?raw=true "Weird Trace")