Category: Maldev

It has been some time since my last post. Professional commitments, personal life, and preparation for the HackTheBox CAPE exam (more on that later) have kept me busy. During my exam preparation, one of the topics covered in the CAPE course is defense evasion, and while the underlying concepts are not particularly complex, it often boils down to obfuscating open-source tooling to bypass AV signatures. This workflow is inherently repetitive: clone the repository, perform manual string obfuscation, rename variables and project metadata, and finally, pass the binary through whatever binary obfuscation tool. For a single project, this process can easily consume an hour or more to achieve a somewhat decent evasion rate, and that's only if you're hoping it doesn't completely break the tool in the process (looking at you, Rubeus).

My recent exploration into C2 frameworks led me to BishopFox's Sliver project. While its capabilities are impressive, I quickly encountered a common challenge: Windows Defender's detection of beacon payloads on my Windows VM. In order to enhance my red teaming skills, I decided to dig into leveraging a custom stager, DInvoke and FilelessPELoader, together with common evasion techniques for building my own Sliver shellcode loader.