Defense Evasion

The RETurn of AMSI – Easy DLL Patching without C3

Leave a Comment / General, Red Team / gares

TL;DR For people that just want the slides and github link AMSI and ETW detections If you’ve been tapped into Defender (Home and / or Endpoint Product) since the end of Summer 2024, you’ve no doubt seen the newer AMSI and ETW patch detections. In fact, a lot of tooling has changed as a result. […]

The RETurn of AMSI – Easy DLL Patching without C3 Read More »

Evading EDR by DLL Sideloading in C#

Leave a Comment / Presentations, Red Team / gares

The blog post accompanies my public conference talks on this topic. Slides are available at the bottom. One thing I learned from doing this talk is that a surprisingly high number of InfoSec professionals believe that bypassing EDR is not possible or is an exception. It should be more common knowledge that security tools can

Evading EDR by DLL Sideloading in C# Read More »