Red Team and Purple Team exercises require running TTPs under EDR's nose.
The malware below incorporates several techniques used together to get passed through EDR scans:
NT API Calls (Direct Syscalls) – Bypassing user-mode hooks
PPID Spoofing – Masquerading as a legitimate process
Encrypted Shellcode – Avoiding static detection
Process Mitigation Policies – Prevents modules from loading into the implant
Thread Stack Spoofing – Hiding malicious execution flows
Sleepmask Obfuscation – Evading memory scanners
Thread Stack Spoofing
EDR solutions perform call stack analysis to identify malicious execution flows by walking stack frames during sensitive API calls (SleepEx). Thread stack spoofing subverts this detection mechanism by manipulating return addresses and stack pointers prior to executing payloads.
The Cobalt Strike Artifact Kit enhances this technique through fiber-based execution, which provides an alternative scheduling mechanism that bypasses standard thread-based inspection. By converting the primary thread to a fiber.
After generating and executing a new payload, you will see that the call stack now returns to RtlUserFibreStart instead of SleepEx
Sleepmask Obfuscation
Sleepmask techniques dynamically encrypt in-memory payloads during sleep operations to thwart memory scanning tools like PE-sieve or Moneta. When the malware enters an idle state (e.g., via Sleep()), critical code sections such as shellcode or reflective DLLs are XOR/AES-encrypted in real-time, while only leaving behind a small, benign-looking stub. The decryption key remains in volatile registers or stack variables, ensuring the payload disappears from memory dumps.
🔹 Runtime Protection: Memory regions are temporarily unmapped or marked as PAGE_NOACCESS during scans.
🔹 Anti-Forensics: Defeats signature-based scans by transforming memory artifacts while preserving execution flow.
This method forces analysts to catch the payload mid-decryption, significantly reducing detection windows. (Debugger screenshots showing memory before/after sleepmask?) 🕵️♂️💻
XORed Shellcode Generation
"Scramble payloads on compile-time to evade static scans. A simple XOR cipher flips bits to break signature detection while keeping runtime decryption trivial."
PPID Spoofing: Masquerading as Legitimate Processes
Modern EDR solutions monitor process creation events, flagging suspicious parent-child relationships (e.g., cmd.exe spawning powershell.exe). PPID (Parent Process ID) spoofing bypasses this by making malicious processes appear to descend from trusted system processes like explorer.exe or msedge.exe.
The technique works by:
Creating a suspended process via CreateProcess with CREATE_SUSPENDED
Using NtQueryInformationProcess to locate and modify the PEB's parent PID
Calling NtResumeProcess to activate the process with its spoofed parentage
Direct Syscalls +In-memory Shellcode + Process Mitigation Policies + PPID
