<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Antivirus &#8211; SCRT Team Blog</title>
	<atom:link href="/category/antivirus/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Wed, 11 Dec 2024 08:17:44 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>Antivirus &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Attacking Cortex XDR from an unprivileged user perspective</title>
		<link>/2024/12/05/attacking-cortex-xdr-from-an-unprivileged-user-perspective/</link>
		
		<dc:creator><![CDATA[Romain Melchiorre]]></dc:creator>
		<pubDate>Thu, 05 Dec 2024 12:49:41 +0000</pubDate>
				<category><![CDATA[Antivirus]]></category>
		<category><![CDATA[Research]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=6405</guid>

					<description><![CDATA[In late 2023, we launched a new form of service where multiple customers could co-fund research time on a given product they are all using. The goal of the Co-funded research is to find vulnerabilities and possible weaknesses within the product that could impact not only our customers&#8217; security, but anyone using the product. The &#8230; <a href="/2024/12/05/attacking-cortex-xdr-from-an-unprivileged-user-perspective/" class="more-link">Continue reading <span class="screen-reader-text">Attacking Cortex XDR from an unprivileged user perspective</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Engineering antivirus evasion (Part III)</title>
		<link>/2022/04/19/3432/</link>
		
		<dc:creator><![CDATA[plowsec]]></dc:creator>
		<pubDate>Tue, 19 Apr 2022 10:05:00 +0000</pubDate>
				<category><![CDATA[Antivirus]]></category>
		<guid isPermaLink="false">/?p=3432</guid>

					<description><![CDATA[Previous blog posts addressed the issue of static artefacts that can easily be caught by security software, such as strings and API imports: This one provides an additional layer of obfuscation to target another kind of detection mechanism used to monitor a program’s activity, i.e userland hooks. As usual, source code was published at https://github.com/scrt/avcleaner &#8230; <a href="/2022/04/19/3432/" class="more-link">Continue reading <span class="screen-reader-text">Engineering antivirus evasion (Part III)</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Statically encrypt strings in a binary with Keystone, LIEF and radare2/rizin</title>
		<link>/2022/04/11/statically-encrypt-strings-in-a-binary-with-keystone-lief-and-radare2-rizin/</link>
		
		<dc:creator><![CDATA[plowsec]]></dc:creator>
		<pubDate>Mon, 11 Apr 2022 10:09:00 +0000</pubDate>
				<category><![CDATA[Antivirus]]></category>
		<guid isPermaLink="false">/?p=3447</guid>

					<description><![CDATA[In our journey to try and make our payload fly under the radar of antivirus software, we wondered if there was a simple way to encrypt all the strings in a binary, without breaking anything. We did not find any satisfying solution in the literature, and the project looked like a fun coding exercise so &#8230; <a href="/2022/04/11/statically-encrypt-strings-in-a-binary-with-keystone-lief-and-radare2-rizin/" class="more-link">Continue reading <span class="screen-reader-text">Statically encrypt strings in a binary with Keystone, LIEF and radare2/rizin</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Automatically extracting static antivirus signatures</title>
		<link>/2022/04/05/automatically-extracting-static-antivirus-signatures/</link>
		
		<dc:creator><![CDATA[plowsec]]></dc:creator>
		<pubDate>Tue, 05 Apr 2022 09:42:00 +0000</pubDate>
				<category><![CDATA[Antivirus]]></category>
		<guid isPermaLink="false">/?p=3442</guid>

					<description><![CDATA[This blog post accompanies the talk we gave at Insomni&#8217;hack 2022. The source code as well as the slides can be found at: https://github.com/scrt/avdebugger Introduction What can we do when a tool that we use during pentest engagements becomes detected by antivirus software? For a long time, the answer was: use a packer. After a &#8230; <a href="/2022/04/05/automatically-extracting-static-antivirus-signatures/" class="more-link">Continue reading <span class="screen-reader-text">Automatically extracting static antivirus signatures</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Engineering antivirus evasion (Part II)</title>
		<link>/2020/07/15/engineering-antivirus-evasion-part-ii/</link>
		
		<dc:creator><![CDATA[plowsec]]></dc:creator>
		<pubDate>Wed, 15 Jul 2020 14:33:33 +0000</pubDate>
				<category><![CDATA[Antivirus]]></category>
		<guid isPermaLink="false">/?p=2676</guid>

					<description><![CDATA[tl;dr To interact with the Windows operating system, software often import functions from Dynamic Link Libraries (DLL). These functions are listed in clear-text in a table called Import Address Table and antivirus software tend to capitalise on that to infer malicious behavioural detection. We show ideas and implementation of an obfuscator that allows to refactor &#8230; <a href="/2020/07/15/engineering-antivirus-evasion-part-ii/" class="more-link">Continue reading <span class="screen-reader-text">Engineering antivirus evasion (Part II)</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Engineering antivirus evasion</title>
		<link>/2020/06/19/engineering-antivirus-evasion/</link>
		
		<dc:creator><![CDATA[plowsec]]></dc:creator>
		<pubDate>Fri, 19 Jun 2020 08:54:41 +0000</pubDate>
				<category><![CDATA[Antivirus]]></category>
		<guid isPermaLink="false">/?p=2586</guid>

					<description><![CDATA[This blog post documents some aspects of our research on antivirus software and how we managed to automatically refactor Meterpreter to bypass every AV/EDR we were put up against. While the ideas for every technique and the implementation of the string obfuscation pass are detailed below, we decided to publish details on API imports hiding / syscalls rewriting in future blog posts to keep this one as short as possible.]]></description>
		
		
		
			</item>
		<item>
		<title>Bypass &#8220;Simple&#8221; de proxy antivirus</title>
		<link>/2010/12/02/bypass-simple-de-proxy-antivirus/</link>
					<comments>/2010/12/02/bypass-simple-de-proxy-antivirus/#respond</comments>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Thu, 02 Dec 2010 20:23:31 +0000</pubDate>
				<category><![CDATA[Antivirus]]></category>
		<guid isPermaLink="false">/?p=213</guid>

					<description><![CDATA[Lors d&#8217;un pentest, il n&#8217;est pas rare de rencontrer un serveur proxy filtrant l&#8217;accès Internet. Dans certains cas, le proxy va jusqu&#8217;à analyser les fichiers téléchargés afin de vérifier qu&#8217;ils ne contiennent pas de virus, ce qui peut être&#160;problématique. En partant du principe que l&#8217;antivirus proxy fonctionne à l&#8217;aide de signatures, l&#8217;objectif est de trouver &#8230; <a href="/2010/12/02/bypass-simple-de-proxy-antivirus/" class="more-link">Continue reading <span class="screen-reader-text">Bypass &#8220;Simple&#8221; de proxy antivirus</span></a>]]></description>
		
					<wfw:commentRss>/2010/12/02/bypass-simple-de-proxy-antivirus/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
	</channel>
</rss>
