WEBVTT

00:00:00.140 --> 00:00:02.640
Now that we have covered how defenses can be evaded on

00:00:02.640 --> 00:00:04.870
disk, at runtime, and in memory,

00:00:04.870 --> 00:00:08.440
let's now take a look at how we can avoid detection on the network.

00:00:08.440 --> 00:00:12.350
In some environments, this is extremely easy to achieve.

00:00:12.350 --> 00:00:15.020
In highly secured environments, however,

00:00:15.050 --> 00:00:18.910
one might come across various systems such as intrusion

00:00:18.910 --> 00:00:21.640
detection and intrusion prevention solutions,

00:00:21.650 --> 00:00:24.630
web proxies, and firewalls, to name a few.

00:00:24.640 --> 00:00:27.640
These systems are designed to detect or block

00:00:27.650 --> 00:00:30.560
potentially malicious activity on the network.

00:00:30.740 --> 00:00:32.659
If you have been following along in the course,

00:00:32.670 --> 00:00:35.910
you will have noticed that I have been using the Reverse

00:00:35.920 --> 00:00:39.050
HTTP Meterpreter stagers and payloads.

00:00:39.140 --> 00:00:43.270
The main reason I chose to use them is because they blend in very nicely with

00:00:43.270 --> 00:00:46.900
common network traffic patterns in most corporate networks.

00:00:47.150 --> 00:00:48.220
During this module,

00:00:48.230 --> 00:00:51.350
we will take a look at how we can fly under the radar by

00:00:51.350 --> 00:00:53.800
applying various techniques which will improve our

00:00:53.800 --> 00:00:56.750
tradecraft's evasiveness on the network.

00:00:58.540 --> 00:01:01.160
We will be taking a look at how we can encode the

00:01:01.160 --> 00:01:03.510
Meterpreter payload and extensions.

00:01:03.720 --> 00:01:08.210
We will also discuss how SSL certificates and Ja3 hashes

00:01:08.220 --> 00:01:10.820
can jeopardize your Meterpreter sessions.

00:01:11.010 --> 00:01:13.710
I will also give you some tips and tricks which may

00:01:13.710 --> 00:01:16.060
be used to keep a low profile.

00:01:16.440 --> 00:01:17.080
Finally,

00:01:17.090 --> 00:01:21.150
we will go through a demo where we will bypass Windows Defender on

00:01:21.150 --> 00:01:25.140
disk, at runtime, in memory, and over the network,

00:01:25.150 --> 00:01:28.800
as well as evading network‑level detection systems consisting

00:01:28.800 --> 00:01:33.010
of a Squid proxy tied into the open source Clam AntiVirus

00:01:33.010 --> 00:01:35.460
engine using the ICAP protocol.