Initial Access and Evasion Tactics Training

Day 1 – Classic Initial Access

1. » Hello Mythic C2
2. » Introduction
   1. » Modern Cyberdefence Stack
   2. » Initial Access and Evasion Tactics
   3. » Classic file infection vectors
      1. » Windows Script Host files: VBS/VBE, JS/JSE, HTA, WSF
      2. » AutoIt3
      3. » COM Scriptlets
      4. » Executables
      5. » Maldocs
      6. » CHMs
      7. » LNKs, Polyglot LNKs
   4. » MSI Shenanigans
      1. » MSI weaponization strategies
      2. » Backdooring MSIs

Day 2 – New Hope

1. » The Beauty of HTML Smuggling
2. » Hosting Thy Payloads
3. » Code Signed Threats
   1. » Fantastic Code Certs And Where To Find Them
4. » MSIX + APPX
5. » .NET Tactics
   1. » Local & Remote AppDomain Manager Injections
   2. » Resolving WinAPIs in C# World
6. » ClickOnce Deployments
7. » Containerized Malware
8. » Complex Infection Chains ❤️
   1. » Containers, Triggers, Payloads & Decoys
   2. » Search-MS + WebDAV = 🔥
   3. » Successful Tactics

Day 3 – Executables & Shellcode Loaders

1. » Protectors, Obfuscators
2. » Backdooring EXEs & DLLs
3. » Implant Watermarking
4. » Meet Shellcode Loader
5. » Hiding shellcodes in PE sections, overlay, resources, certificate area
6. » Code Signing & Leaked certificates: MSI, NVIDIA & 5 others
7. » Basic Evasions
   1. » Strings obfuscation
   2. » Entropy, File Bloating, Pumping
   3. » Time-Delayed Execution, Beating Emulators
   4. » Fooling ImpHash
   5. » AMSI, ETW – get off my lawn
   6. » Attacking EDR’s design
8. » Calling WinAPI Safely
   1. » EDR on the Hook
   2. » Direct Syscalls
   3. » Indirect Syscalls
   4. » Asynchronous execution: FOLIAGE-style
9. » Call Stack Obfuscation
   1. » Problem Analysis
   2. » Return Address overwrite
   3. » Spoofing
10. » Other exotic evasions
    1. » Evading Kernel Module Load callbacks
    2. » Queuing LoadLibrary
11. » Outro

Appendix – Maldocs

1. » A guide through VBA infection strategies
2. » Various means to execute implants in VBA – .NET Reflection, XSL Deserialization, and more
3. » “Lures” – how to entice user into enabling macros
4. » Hiding Payloads in Office structures
5. » Alternative Macro autorun techniques
6. » Exotic VBA carriers
   1. » Publisher, RTF files
   2. » Outlook’s VbaProject.OTM
   3. » MS Access, Visio, Project
7. » Evasion Tactics
   1. » Sandbox Evasion
   2. » Office Trusted Paths + AMSI
   3. » Code obfuscation
   4. » File Encryption

This training is designed to supply practical knowledge variety of IT specialists, including:

1. » Penetration Testers
2. » Red Team operators, Purple Team members
3. » SOC analysts, Threat Hunters, Detection Engineers
4. » Security Professionals
5. » IT Support, administrative and network personnel