Belajar Red Team Operator - Advanced Evasion & Detection Bypass

#Pendahuluan

Setelah di episode 22 kita mempelajari LLM/GenAI adversarial — prompt injection dan data exfiltration — pada episode ini kita masuk ke advanced evasion: teknik tingkat lanjut untuk bypass EDR, manipulasi event logs, dan beroperasi di environment dengan pertahanan paling ketat.

Advanced evasion adalah tentang mengetahui bagaimana deteksi bekerja pada level terendah — dan menemukan celah di setiap layer pertahanan.

#EDR Bypass

#Userland Hooks Bypass

text

EDR Hooks
===========
EDR beroperasi dengan menghook API calls di userland:
- NtAllocateVirtualMemory → hooked untuk detect allocation
- NtWriteVirtualMemory → hooked untuk detect write
- NtCreateThreadEx → hooked untuk detect thread creation
 
Bypass: gunakan direct syscalls (bypass userland hooks)

#Direct Syscalls

// Concept: direct syscall to bypass userland hooks
// Instead of calling NtAllocateVirtualMemory (hooked)
// Call syscall directly via assembly
 
// Using HellsGate / HalosGate technique
// Find unhooked syscall number from ntdll.dll
// Execute via syscall instruction directly

#Process Doppelgänging

text

Process Doppelgänging
=======================
1. Create NTFS transaction
2. Write malicious image ke transacted file
3. Create process from transacted file
4. Rollback transaction
5. Process runs from memory (no file on disk)
 
Result: AV/EDR tidak melihat file malicious

#Module Stomping

text

Module Stomping
================
1. Load legitimate DLL (mshtml.dll)
2. Overwrite DLL code di memory dengan malicious code
3. Execute (looks like legitimate module)
 
Result: Process shows legitimate module name

#Event Log Manipulation

#Selective Log Manipulation

bash

# ❌ Noisy: clear entire log
wevtutil cl Security
 
# ✅ Better: remove specific events
# Using PowerShell to selectively remove events
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} |
  ForEach-Object { $_.Remove() }  # Conceptual

#Log Sanitization

text

Event Log Attacks
===================
1. Clear entire log (very suspicious)
2. Remove specific events (better)
3. Modify event timestamps (timestomping)
4. Disable logging before action (best)
5. Use legitimate tools (LOLBins)

#ETW Bypass

// Patch ETW (Event Tracing for Windows)
// ETW feeds data ke SIEM — disable = blind
 
HMODULE hNtdll = GetModuleHandle("ntdll.dll");
FARPROC pEtwEventWrite = GetProcAddress(hNtdll, "EtwEventWrite");
 
// Patch function untuk return immediately
DWORD oldProtect;
VirtualProtect(pEtwEventWrite, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
*(char*)pEtwEventWrite = 0xc3;  // RET
VirtualProtect(pEtwEventWrite, 1, oldProtect, &oldProtect);

#Advanced C2 Evasion

#Domain Fronting

text

Domain Fronting
================
1. Request → Cloudflare (legitimate CDN)
2. Cloudflare → forward ke attacker server
3. Network monitoring melihat HTTPS ke Cloudflare
4. Tetapi actual destination adalah C2
 
Result: C2 traffic tersembunyi dalam legitimate CDN traffic

#Encrypted Channel Evasion

text

C2 Channel Evasion
====================
1. HTTPS with legitimate cert (Let's Encrypt)
2. DNS over HTTPS (DoH)
3. ICMP tunneling
4. WebSocket connections
5. HTTP/2 multiplexing

#Memory Evasion

#In-Memory Execution

text

In-Memory Techniques
======================
1. Reflective DLL injection
   → Load DLL dari memory, bukan disk
 
2. Process hollowing
   → Create suspended process → replace memory
 
3. Herpaderp
   → Modify file setelah AV scan
 
4. Module overloading
   → Load legitimate DLL → overwrite code

#Memory Scanning Bypass

text

Bypass Memory Scan
====================
1. Sleep obfuscation
   → Sleep → XOR encrypt memory → wake → decrypt
 
2. Stack spoofing
   → Fake call stack → confuse scanners
 
3. Syscall-based execution
   → Bypass userland API hooks
 
4. Unhooking
   → Restore original API functions

Warning

Advanced evasion techniques membutuhkan pemahaman mendalam tentang Windows internals, memory management, dan EDR architecture. Praktik di lab sebelum menggunakannya dalam engagement.

#Praktik: Advanced Evasion Lab

bash

# 1. Setup lab dengan EDR (CrowdStrike/SentinelOne trial)
# 2. Test basic execution → pastikan terdeteksi
# 3. Test process injection → bandingkan detection
# 4. Test direct syscalls → bandingkan detection
# 5. Test ETW patching → bandingkan detection
# 6. Document: technique mana yang berhasil

#Penutup

Inti yang harus dibawa pulang:

EDR bypass: direct syscalls, process doppelgänging, module stomping.
Event log: selective manipulation, timestomping, ETW patching.
C2 evasion: domain fronting, DNS over HTTPS, encrypted channels.
Memory evasion: in-memory execution, sleep obfuscation, stack spoofing.

Di episode 24 selanjutnya, kita akan mempelajari advanced persistent emulation — APT emulation, state-sponsored TTPs, dan campaign realism.