Skip to content
-
Blend C2 into trusted traffic with domain fronting
A TLS SNI for a high-reputation CDN domain with a Host header pointing at your backend routes command traffic through infrastructure defenders trust.
Red Team & Evasion
-
Encrypt beacon memory during sleep to defeat scanners
Encrypting your implant's pages while it waits and restoring RW to RX only during execution hides it from periodic memory scans.
Red Team & Evasion
-
Kill EDR from kernel space with a vulnerable driver
A signed but exploitable driver gives you kernel primitives to terminate or blind protected security processes user mode cannot touch.
Red Team & Evasion
-
Spoof the parent process and block non-Microsoft DLLs
Reparenting a spawned process under explorer.exe and setting the block-non-Microsoft-DLL policy breaks EDR user-mode hooks and heuristics at once.
Red Team & Evasion
-
Blind ETW to strip .NET and process telemetry
Neutering EtwEventWrite in your process stops the CLR and many sensors from reporting your activity to userland providers.
Red Team & Evasion
-
Patch AMSI in memory before loading tooling
A single-byte patch to AmsiScanBuffer in the current process disables the scan for every script and assembly you load afterwards.
Red Team & Evasion
-
Restore clean syscalls by unhooking ntdll
EDRs patch userland ntdll functions; mapping a fresh copy from disk removes their hooks before you make sensitive calls.
Red Team & Evasion
-
Stage and execute with signed LOLBins
Trusted Windows binaries fetch and run code, avoiding a fresh unsigned executable on disk.
Red Team & Evasion
-
Fingerprint egress channels before delivering a payload
Learn which outbound paths a host allows first, then pick a C2 channel that blends with normal traffic.
Red Team & Evasion