Malware Development

DLL Notification Injection

New “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes.

14.08.2023

Mor Davidovich

MalRDP: Implementing Rouge RDP Manually

Weaponizing RDP files for phishing and initial access. Based on the work of Mike Felch on Rouge RDP technique.

21.07.2023

Mor Davidovich

DLL Proxying DLL Sideloading Malware Development Phishing

It’s all in the details: The curious case of an LSASS dumper gone undetected

Let me first start by saying I will not be revealing in this post any novel techniques or new research that hasn’t been seen before. I will, however, reveal my own methodology when it comes to finding gaps in EDRs visibility in order to bypass detection.

14.11.2022

Mor Davidovich

DLL Proxying DLL Sideloading Evasion LSASS Dumping Malware Development

Execute any "evil" Powershell code by bypassing AMSI

Powershell can be a powerful tool during the post-exploitation phase of our engagements. But what if AMSI will not let us use any of its capabilities?

08.11.2019

Mor Davidovich

Evasion Malware Development