[Kxd]

Personally for you guys, which is the most and least hard persistence technique (talking about implementation) that dont relay on exploits?


(sorry for bad english, lol)

[basileusapoleia]

Personally for you guys, which is the most and least hard persistence technique (talking about implementation) that dont relay on exploits?


(sorry for bad english, lol)

DLL proxying in my opinion, fast reliabe and idk why AV/EDR don't detect this

[red_dot]

Personally for you guys, which is the most and least hard persistence technique (talking about implementation) that dont relay on exploits?


(sorry for bad english, lol)

DLL proxying in my opinion, fast reliabe and idk why AV/EDR don't detect this

I would also recommend DDL proxying/hijacking

[Kxd]

Personally for you guys, which is the most and least hard persistence technique (talking about implementation) that dont relay on exploits?


(sorry for bad english, lol)

DLL proxying in my opinion, fast reliabe and idk why AV/EDR don't detect this

I would also recommend DDL proxying/hijacking

DLL hijacking is still an option in these days? like, i thought microsoft stopped using relative paths since dll hijacking became famous

[red_dot]

Personally for you guys, which is the most and least hard persistence technique (talking about implementation) that dont relay on exploits?


(sorry for bad english, lol)

DLL proxying in my opinion, fast reliabe and idk why AV/EDR don't detect this

I would also recommend DDL proxying/hijacking

DLL hijacking is still an option in these days? like, i thought microsoft stopped using relative paths since dll hijacking became famous

I was think more of finding exe that loads dll that doesn't exists in same directory or does not exists at all. For example Opera have dbghelp.dll in it's IAT. Also u can create DLL proxy, rename original DLL, place ur own at its place and redirect all function calls to copied DLL that ur proxy DLL loaded. Hope it makes sense

[Nevertheless]

I used WMI Event Subscription back then
Nowadays I go for obscure shit that there is no chance someone writes a detection rule for.

[red_dot]

I used WMI Event Subscription back then
Nowadays I go for obscure shit that there is no chance someone writes a detection rule for.

Nice, i think the only best way to make good malware is to invent as much custom techniques as u can so it's standing out of standard looking mw

[Nevertheless]

I used WMI Event Subscription back then
Nowadays I go for obscure shit that there is no chance someone writes a detection rule for.

Nice, i think the only best way to make good malware is to invent as much custom techniques as u can so it's standing out of standard looking mw

Exactly

[red_dot]

I used WMI Event Subscription back then
Nowadays I go for obscure shit that there is no chance someone writes a detection rule for.

https://wikileaks.org/ciav7p1/cms/page_14587908.html

u fed bruh? 

[Kxd]

Personally for you guys, which is the most and least hard persistence technique (talking about implementation) that dont relay on exploits?


(sorry for bad english, lol)

DLL proxying in my opinion, fast reliabe and idk why AV/EDR don't detect this

I would also recommend DDL proxying/hijacking

DLL hijacking is still an option in these days? like, i thought microsoft stopped using relative paths since dll hijacking became famous

I was think more of finding exe that loads dll that doesn't exists in same directory or does not exists at all. For example Opera have dbghelp.dll in it's IAT. Also u can create DLL proxy, rename original DLL, place ur own at its place and redirect all function calls to copied DLL that ur proxy DLL loaded. Hope it makes sense

Oh yeah, i've heard of dll's that don't exist but programs still try to load them and then if you put a dll with the same name they will load it and all, pretty cool though, thank you!

---

I used WMI Event Subscription back then
Nowadays I go for obscure shit that there is no chance someone writes a detection rule for.

Shit that sounds cool as hell, any tips of where to begin writing my own custom shit? Like to don't need ro rely on already used techniques. Im kinda clueless on where to start doing these type of stuff