Record · corpus.blog/posts/01a08745-ac63-729c-a65a-9eb3013dd123

Hiding in Plain Sight: Unlinking Malicious DLLs from the PEB

blog.christophetd.fr · published 21 April 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at blog.christophetd.fr Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 25
Words captured: 2,543

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://twitter.com/bradgeesaman/

twitter.com

https://attack.mitre.org/beta/techniques/T1055/001/

attack.mitre.org

https://ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection

ired.team

https://attack.mitre.org/techniques/T1574/001/

attack.mitre.org

https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess

docs.microsoft.com

https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya

docs.microsoft.com

https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread

docs.microsoft.com

https://gist.github.com/christophetd/b37c780d973cb2272562cde10af7596d

gist.github.com

https://github.com/volatilityfoundation/volatility/wiki/Command-Reference

github.com

https://akovid.blogspot.com/2014/04/difference-among-dlllistldrmodulesand.html

akovid.blogspot.com

https://iratoon.medium.com/malware-analysis-using-volatility-part-3-d3f6dd030d42

iratoon.medium.com

https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/

sans.org

https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb

docs.microsoft.com

https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb_ldr_data

docs.microsoft.com

https://docs.google.com/drawings/d/1IRyOCwsAKB0F2MH0Xaw1NDzjO87sYAjL-r7M-3VNY8w/edit

docs.google.com

https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/mm-bad-pointer

docs.microsoft.com

https://docs.google.com/drawings/d/1ni9GCdsM--p3J2mzarBCcM9spSYBbA1jV_yn_6LzXCg/edit?usp=sharing

docs.google.com

https://www.sciencedirect.com/science/article/pii/S1742287607000503

sciencedirect.com

https://github.com/winsiderss/systeminformer/blob/02ccd789f83e118a58b36137a7d3561cd0b87fd6/phlib/mapldr.c

github.com

https://github.com/volatilityfoundation/volatility/wiki/Command-Reference-Mal

github.com

https://www.welivesecurity.com/2012/07/20/flame-in-depth-code-analysis-of-mssecmgr-ocx/

welivesecurity.com

https://www.mdpi.com/1999-5903/4/4/971

mdpi.com

https://www.wiley.com/en-us/Malware+Analyst's+Cookbook+and+DVD:+Tools+and+Techniques+for+Fighting+Malicious+Code-p-9780470613030

wiley.com

https://www.blackhat.com/docs/asia-17/materials/asia-17-KA-What-Malware-Authors-Don%27t-Want-You-To-Know-Evasive-Hollow-Process-Injection.pdf

blackhat.com

https://docs.google.com/presentation/d/1KsZGF6cQ-N8ngABFGCZf8pTQQ5CZ19VoAHq5cO5ZPdE/htmlpresent

docs.google.com