corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a0ca91-2be9-729c-a46c-8dd080705798

Detection evasion in CLR and tips on how to detect such attacks

Kaspersky Securelist · published 21 September 2021

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at securelist.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
62
Words captured
2,926

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://github.com/gentilkiwi/mimikatz/
github.com
https://github.com/BloodHoundAD/SharpHound3
github.com
https://github.com/GhostPack/Seatbelt
github.com
https://github.com/GhostPack/Rubeus
github.com
https://github.com/GhostPack/
github.com
https://medium.com/@johnlatwc/the-githubification-of-infosec-afbdbfaad1d1
medium.com
https://lolbas-project.github.io/
lolbas-project.github.io
https://troopers.de/media/filer_public/82/de/82de5e58-0bd1-447a-b4f9-8a908ad2ef70/mind_the_gap_-_final.pdf
troopers.de
https://en.wikipedia.org/wiki/Common_Language_Runtime
en.wikipedia.org
https://docs.microsoft.com/en-us/dotnet/standard/assembly/
docs.microsoft.com
https://en.wikipedia.org/wiki/Common_Intermediate_Language
en.wikipedia.org
https://en.wikipedia.org/wiki/Just-in-time_compilation
en.wikipedia.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20155516/Abnormal_CLR_activities_01.png
media.kasperskycontenthub.com
https://ru.wikipedia.org/wiki/Common_Language_Runtime
ru.wikipedia.org
https://docs.microsoft.com/en-us/dotnet/standard/assembly/contents
docs.microsoft.com
https://en.wikipedia.org/wiki/Reflective_programming
en.wikipedia.org
https://docs.microsoft.com/en-us/dotnet/standard/assembly/manifest
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/framework/performance/clr-etw-providers
docs.microsoft.com
https://en.wikipedia.org/wiki/Managed_code
en.wikipedia.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20155629/Abnormal_CLR_activities_02.png
media.kasperskycontenthub.com
https://docs.microsoft.com/ru-ru/dotnet/standard/assembly/
docs.microsoft.com
https://stackoverflow.com/a/27881763
stackoverflow.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20155723/Abnormal_CLR_activities_03.jpeg
media.kasperskycontenthub.com
https://github.com/cobbr/Covenant
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20155808/Abnormal_CLR_activities_04.png
media.kasperskycontenthub.com
https://github.com/gentilkiwi/mimikatz
github.com
https://github.com/TheWover/donut
github.com
https://github.com/3xpl01tc0d3r/ProcessInjection
github.com
https://www.dmzero.net/injection-standard.html
dmzero.net
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
docs.microsoft.com
https://github.com/SwiftOnSecurity/sysmon-config
github.com
https://twitter.com/SwiftOnSecurity
twitter.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20160143/Abnormal_CLR_activities_05.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20160727/Abnormal_CLR_activities_05-2.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20161334/Abnormal_CLR_activities_06.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20161457/Abnormal_CLR_activities_07.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20161646/Abnormal_CLR_activities_08.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20161819/Abnormal_CLR_activities_09.png
media.kasperskycontenthub.com
https://docs.microsoft.com/en-us/dotnet/framework/app-domains/gac
docs.microsoft.com
https://github.com/dotnet/runtime/blob/16c48d6a45d4d706c327fc840e1a5d450fb189ae/src/coreclr/inc/clrconfigvalues.h
github.com
https://github.com/dotnet/docs/blob/main/docs/framework/configure-apps/file-schema/runtime/loadfromremotesources-element.md
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20161918/Abnormal_CLR_activities_10.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162219/Abnormal_CLR_activities_11.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162238/Abnormal_CLR_activities_12.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162328/Abnormal_CLR_activities_13.png
media.kasperskycontenthub.com
https://github.com/gam4er/SneakyRun/tree/master/KatzAssembly
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162400/Abnormal_CLR_activities_14.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162427/Abnormal_CLR_activities_15.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162503/Abnormal_CLR_activities_16.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162527/Abnormal_CLR_activities_17.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162552/Abnormal_CLR_activities_18.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162621/Abnormal_CLR_activities_19.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162649/Abnormal_CLR_activities_20.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162724/Abnormal_CLR_activities_21.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162808/Abnormal_CLR_activities_22.png
media.kasperskycontenthub.com
https://github.com/fireeye/SilkETW
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162842/Abnormal_CLR_activities_23.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162913/Abnormal_CLR_activities_24.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/20162950/Abnormal_CLR_activities_25.png
media.kasperskycontenthub.com
https://github.com/JamesNK/Newtonsoft.Json
github.com
https://github.com/gam4er/SneakyRun
github.com
https://gist.github.com/gam4er/f9d0ed93697f08fc32ddb11fdcec6136
gist.github.com