corpus.blog
42,390 blogs · 5,361,753 posts Claim your blog
Record · corpus.blog/posts/01a0878d-be1a-728d-b309-35083345bc3c

Red Team Tactics: Utilizing Syscalls in C# - Prerequisite Knowledge

jhalon.github.io · published 14 April 2020

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at jhalon.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
73
Words captured
6,903

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://docs.microsoft.com/en-us/cpp/c-runtime-library/system-calls?view=vs-2019
docs.microsoft.com
https://www.crowdstrike.com/epp-101/what-is-endpoint-detection-and-response-edr/
crowdstrike.com
https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
medium.com
https://twitter.com/SpecialHoang
twitter.com
https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
outflank.nl
https://twitter.com/Cneelis
twitter.com
https://docs.microsoft.com/en-us/windows/win32/apiindex/windows-api-list
docs.microsoft.com
https://twitter.com/FuzzySec
twitter.com
https://twitter.com/TheRealWover
twitter.com
https://github.com/FuzzySecurity/BlueHatIL-2020]
github.com
https://outflank.nl/wp-content/uploads/2019/06/Picture4.png
outflank.nl
https://upload.wikimedia.org/wikipedia/commons/thumb/2/2f/Priv_rings.svg/1200px-Priv_rings.svg.png
upload.wikimedia.org
https://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/virtual-address-spaces
docs.microsoft.com
https://flylib.com/books/en/4.419.1.29/1/
flylib.com
https://docs.microsoft.com/en-us/windows/win32/sysinfo/handles-and-objects
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/memory/file-mapping
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualprotect?redirectedfrom=MSDN
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-writeprocessmemory
docs.microsoft.com
https://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/images/virtualaddressspace01.png
docs.microsoft.com
https://en.wikipedia.org/wiki/Kernel_Patch_Protection
en.wikipedia.org
https://en.wikipedia.org/wiki/Ntoskrnl.exe
en.wikipedia.org
https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntcreatefile
docs.microsoft.com
https://en.wikipedia.org/wiki/Native_API
en.wikipedia.org
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools
docs.microsoft.com
https://twitter.com/j00ru
twitter.com
https://j00ru.vexillium.org/syscalls/nt/64/
j00ru.vexillium.org
https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwcreatefile
docs.microsoft.com
https://docs.microsoft.com/en-us/cpp/assembler/masm/masm-for-x64-ml64-exe?view=vs-2019
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/standard/clr
docs.microsoft.com
https://en.wikipedia.org/wiki/Common_Language_Infrastructure
en.wikipedia.org
https://docs.microsoft.com/en-us/dotnet/standard/managed-code
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/standard/managed-execution-process
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/standard/garbage-collection/fundamentals
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/csharp/getting-started/media/introduction-to-the-csharp-language-and-the-net-framework/net-architecture-relationships.png
docs.microsoft.com
https://cwe.mitre.org/data/definitions/416.html
cwe.mitre.org
https://github.com/0xd4d/dnSpy
github.com
https://docs.microsoft.com/en-us/dotnet/standard/native-interop/pinvoke
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system?view=netframework-4.8
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices?view=netframework-4.8
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-messagebox
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/winprog/windows-data-types
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/csharp/tour-of-csharp/types-and-variables
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.intptr?view=netframework-4.8
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/csharp/programming-guide/strings/
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.dllimportattribute?view=netframework-4.8
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/standard/native-interop/charset
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/desktop/api/errhandlingapi/nf-errhandlingapi-setlasterror
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.marshal.getlastwin32error
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/extern
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/secauthz/generic-access-rights
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/secauthz/access-mask-format
docs.microsoft.com
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/262627d8-3418-4627-9218-4ffe110850b2
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/struct
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.flagsattribute?view=netframework-4.8
docs.microsoft.com
https://www.pinvoke.net/
pinvoke.net
https://stackoverflow.com/questions/3434202/what-is-the-difference-between-native-code-machine-code-and-assembly-code
stackoverflow.com
https://docs.microsoft.com/en-us/dotnet/csharp/programming-guide/delegates/
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-enumwindows
docs.microsoft.com
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms633498%28v=vs.85%29
docs.microsoft.com
https://beahealthygeek.com/wp-content/uploads/2016/07/patience_grasshopper.jpg
beahealthygeek.com
https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualalloc
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/standard/native-interop/type-marshaling
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.marshal?view=netframework-4.8
docs.microsoft.com
https://mark-borg.github.io/img/posts/pinvoke-diagram.png
mark-borg.github.io
https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.marshal.getdelegateforfunctionpointer?view=netframework-4.8
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/unsafe
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/unsafe-compiler-option
docs.microsoft.com
https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-ntopenprocess
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/fixed-statement
docs.microsoft.com