WEBVTT

00:00:00.140 --> 00:00:02.080
Now that we have a good understanding of how we can

00:00:02.080 --> 00:00:04.500
evade detection on disk and at runtime,

00:00:04.500 --> 00:00:08.360
let's take a closer look at how we can evade in‑memory detections.

00:00:08.420 --> 00:00:10.450
You may recall from the Meterpreter deep dive

00:00:10.450 --> 00:00:14.660
module that the Meterpreter payload, also known as metsrv.dll,

00:00:14.670 --> 00:00:16.010
is loaded from memory.

00:00:16.239 --> 00:00:20.130
This also applies to all subsequent extensions which can be loaded at

00:00:20.130 --> 00:00:23.760
runtime, such as Mimikatz and Incognito, to name a few.

00:00:23.940 --> 00:00:27.960
Because these modules are loaded at runtime entirely from memory,

00:00:27.960 --> 00:00:32.619
antivirus and EDR solutions will try to detect them in memory. During this

00:00:32.619 --> 00:00:36.540
module, we will take a closer look at the options we can choose from to

00:00:36.540 --> 00:00:39.430
make our tradecraft more evasive in memory.

00:00:39.670 --> 00:00:44.050
We will then go through a demo where we make some modifications to the payload

00:00:44.060 --> 00:00:47.900
and extensions in an attempt to make them harder to detect.