book

Antivirus Bypass Techniques

Name: Antivirus Bypass Techniques
ISBN: 9781801079747

by Nir Yehoshua, Uriel Kosayev

July 2021

Beginner to intermediate

242 pages

4h 39m

English

Packt Publishing

Read now

Unlock full access

Antivirus Bypass Techniques
Recommendation ContributorsAbout the authorsReviewer
Preface
Who this book is forWhat this book coversTo get the most out of this bookCode in ActionDownload the color imagesConventions usedDisclaimerGet in touchReviews
Section 1: Know the Antivirus – the Basics Behind Your Security Solution
Chapter 1: Introduction to the Security Landscape
Understanding the security landscapeDefining malwareTypes of malwareExploring protection systemsAntivirus – the basicsAntivirus bypass in a nutshellSummary
Chapter 2: Before Research Begins
Technical requirementsGetting started with the researchThe work environment and lead gatheringProcess ThreadRegistry Defining a leadWorking with Process ExplorerWorking with Process MonitorWorking with AutorunsWorking with RegshotThird-party enginesSummary
Chapter 3: Antivirus Research Approaches
Understanding the approaches to antivirus researchIntroducing the Windows operating system Understanding protection rings Protection rings in the Windows operating systemWindows access control listPermission problems in antivirus softwareInsufficient permissions on the static signature fileImproper privilegesUnquoted Service PathDLL hijackingBuffer overflowStack-based buffer overflowBuffer overflow – antivirus bypass approachSummary
Section 2: Bypass the Antivirus – Practical Techniques to Evade Antivirus Software
Chapter 4: Bypassing the Dynamic Engine
Technical requirementsThe preparationBasic tips for antivirus bypass researchVirusTotalVirusTotal alternativesAntivirus bypass using process injectionWhat is process injection?Windows APIClassic DLL injectionProcess hollowingProcess doppelgängingProcess injection used by threat actorsAntivirus bypass using a DLLPE filesPE file format structureThe executionAntivirus bypass using timing-based techniquesWindows API calls for antivirus bypassMemory bombing – large memory allocationSummaryFurther reading
Chapter 5: Bypassing the Static Engine
Technical requirementsAntivirus bypass using obfuscationRename obfuscationControl-flow obfuscationIntroduction to YARAHow YARA detects potential malwareHow to bypass YARAAntivirus bypass using encryptionOligomorphic codePolymorphic codeMetamorphic codeAntivirus bypass using packingHow packers workThe unpacking processPackers – false positivesSummary
Chapter 6: Other Antivirus Bypass Techniques
Technical requirementsAntivirus bypass using binary patchingIntroduction to debugging / reverse engineeringTimestompingAntivirus bypass using junk codeAntivirus bypass using PowerShellAntivirus bypass using a single malicious functionalityThe power of combining several antivirus bypass techniquesAn example of an executable before and after peCloakAntivirus engines that we have bypassed in our researchSummaryFurther reading

Section 3: Using Bypass Techniques in the Real World
Chapter 7: Antivirus Bypass Techniques in Red Team Operations
Technical requirementsWhat is a red team operation?Bypassing antivirus software in red team operationsFingerprinting antivirus softwareSummary
Chapter 8: Best Practices and Recommendations
Technical requirements Avoiding antivirus bypass dedicated vulnerabilitiesHow to avoid the DLL hijacking vulnerabilityHow to avoid the Unquoted Service Path vulnerabilityHow to avoid buffer overflow vulnerabilitiesImproving antivirus detectionDynamic YARAThe detection of process injectionScript-based malware detection with AMSISecure coding recommendationsSelf-protection mechanismPlan your code securelyDo not use old codeInput validationPoLP (Principle of Least Privilege)Compiler warningsAutomated code testingWait mechanisms – preventing race conditionsIntegrity validationSummary
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youLeave a review - let other readers know what you think

Content preview from Antivirus Bypass Techniques

Chapter 6: Other Antivirus Bypass Techniques

In this chapter, we will go into deeper layers of understanding antivirus bypass techniques. We will first introduce you to Assembly x86 code so you can better understand the inner mechanisms of operating systems, compiled binaries, and software, then we will introduce you to the concept, usage, and practice of reverse engineering. Afterward, we will go through implementing antivirus bypass using binary patching, and then the use of junk code to circumvent and harden the analysis conducted by security researchers and antivirus software itself. Also, we will learn how to bypass antivirus software using PowerShell code, and the concept behind the use of a single malicious functionality.

In this chapter, ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System, 2nd Edition

Publisher Resources

ISBN: 9781801079747

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Antivirus Bypass Techniques

by Nir Yehoshua, Uriel Kosayev

Chapter 6: Other Antivirus Bypass Techniques

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.