WEBVTT

00:00:00.240 --> 00:00:04.240
Now that we have covered how to evade detection on disk, let's focus

00:00:04.240 --> 00:00:08.790
our attention on heuristics. As explained in the antivirus and EDR

00:00:08.790 --> 00:00:13.530
module, many techniques are leveraged by antivirus and EDR to detect

00:00:13.530 --> 00:00:15.780
malicious activity. In this module,

00:00:15.790 --> 00:00:19.140
we will take a look at how we can get around many of these security

00:00:19.140 --> 00:00:22.350
mechanisms using a variety of different techniques.

00:00:22.940 --> 00:00:26.750
We will start by discussing how API monitoring can be evaded.

00:00:27.140 --> 00:00:29.640
I will show you how to improve our stager so that it

00:00:29.640 --> 00:00:32.470
will remove any API hooks at runtime,

00:00:32.479 --> 00:00:36.650
which in turn might be enough to blind certain antivirus solutions.

00:00:36.930 --> 00:00:41.020
We shall then discuss anti‑emulation and anti‑sandboxing techniques.

00:00:41.440 --> 00:00:45.080
We will also take a closer look at how AMSI can be evaded by

00:00:45.080 --> 00:00:49.440
rewriting our stager in PowerShell and using various techniques to

00:00:49.440 --> 00:00:51.920
ensure it doesn't get flagged when executed.

00:00:52.210 --> 00:00:52.870
Finally,

00:00:52.880 --> 00:00:56.280
we will go through a demo where we will improve our stager and

00:00:56.280 --> 00:00:59.460
partially bypass Windows Defender at runtime.