Week of August 21, 2023

During a penetration test, researchers bypassed ESET NOD32 antivirus by modifying the Meterpreter DLL source and recompiling, and by embedding encoded shellcode in a custom executable with a filename check to evade signature detection. The technique demonstrates a practical AV evasion method using open-source tool customization.

Unit 42 investigated an extortion attack where a threat actor used a modified version of the open-source EDRsandblast tool, named disabler.exe, to bypass Cortex XDR via a BYOVD technique. The attacker inadvertently exposed their toolkit and identity by connecting rogue endpoints to the victim's network. The tool disabled EDR to allow execution of Mimikatz for credential dumping.

Percino is an open-source Golang loader that executes shellcode via process hollowing with anti-sandbox and anti-analysis features. It encrypts shellcode with 3DES and claims full EDR bypass, tested against Microsoft Defender for Endpoint with Cobalt Strike.