corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a0821a-f74f-7216-9ec5-04f4e7c021a9

Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion

Bohops · published 16 March 2021

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at bohops.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
33
Words captured
2,188

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://stackoverflow.com/questions/20620348/how-and-when-does-ngen-exe-work
stackoverflow.com
https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
blog.menasec.net
https://twitter.com/olafhartong
twitter.com
https://github.com/olafhartong/sysmon-modular
github.com
https://github.com/olafhartong/sysmon-modular/blob/master/11_file_create/include_dotnet.xml
github.com
https://github.com/steveharter/dotnet_coreclr/blob/master/Documentation/project-docs/clr-configuration-knobs.md
github.com
https://twitter.com/_xpn_
twitter.com
Hiding your .NET - COMPlus_ETWEnabled Read at the source ↗
blog.xpnsec.com
https://twitter.com/am0nsec
twitter.com
https://www.contextis.com/en/blog/bring-your-own-net-core-garbage-collector
contextis.com
https://web.archive.org/web/20170720041203/http://subt0x10.blogspot.com/2017/05/subvert-clr-process-listing-with-net.html
web.archive.org
https://pentestlaboratories.com/2020/05/26/appdomainmanager-injection-and-detection/
pentestlaboratories.com
https://twitter.com/netbiosX
twitter.com
https://gist.github.com/xpn/64e5b6f7ad370c343e3ab7e9f9e22503
gist.github.com
https://gist.github.com/bohops/a79d3e07d06546f6fc87fcc21929849f
gist.github.com
https://docs.microsoft.com/en-us/dotnet/api/system.environment.exit?view=net-5.0
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.process.kill?view=net-5.0
docs.microsoft.com
https://github.com/TheWover/DInvoke
github.com
https://twitter.com/TheRealWover
twitter.com
https://twitter.com/FuzzySec
twitter.com
https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-freelibrary
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.marshal.getdelegateforfunctionpointer?view=net-5.0
docs.microsoft.com
https://en.wikipedia.org/wiki/Process_Environment_Block
en.wikipedia.org
https://thewover.github.io/Dynamic-Invoke/
thewover.github.io
https://gist.github.com/bohops/345f52a657811bb6606fcc506ec07a10
gist.github.com
https://www.elastic.co/guide/en/security/master/suspicious-managed-code-hosting-process.html
elastic.co
https://twitter.com/SBousseaden
twitter.com
https://twitter.com/SBousseaden/status/1350780409387343877
twitter.com
https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Detection_Rules/sysmon_susp_office_dotnet_clr_dll_load.md
github.com
https://twitter.com/Cyb3rWard0g
twitter.com
https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
gist.github.com
https://twitter.com/spotheplanet
twitter.com
https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/etw-event-tracing-for-windows-101
ired.team