Antivirus Bypass Techniques: Learn practical techniques and tactics to combat, bypass, and evade antivirus software

242 Pages·2021·20.754 MB·English

by  Nir Yehoshua, Uriel Kosayev

Antivirus Bypass
Techniques
Learn practical techniques and tactics to combat,
bypass, and evade antivirus software
Nir Yehoshua
Uriel Kosayev
BIRMINGHAM—MUMBAI
Antivirus Bypass Techniques
Copyright © 2021 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or
transmitted in any form or by any means, without the prior written permission of the publisher,
except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the
information presented. However, the information contained in this book is sold without warranty,
either express or implied. Neither the authors, nor Packt Publishing or its dealers and distributors,
will be held liable for any damages caused or alleged to have been caused directly or indirectly by
this book.
Packt Publishing has endeavored to provide trademark information about all of the companies
and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing
cannot guarantee the accuracy of this information.
Group Product Manager: Wilson Dsouza
Publishing Product Manager: Mohd Riyan Khan
Senior Editor: Rahul Dsouza
Content Development Editor: Sayali Pingale
Technical Editor: Sarvesh Jaywant
Copy Editor: Safis Editing
Project Coordinator: Ajesh Devavaram
Proofreader: Safis Editing
Indexer: Pratik Shirodkar
Production Designer: Alishon Mendonca
First published: June 2021
Production reference: 1180721
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.
978-1-80107-974-7
www.packt.com
Recommendation
"Antiviruses have always been a hindrance for threat actors and red
teamers. The book Antivirus Bypass Techniques illustrates various
techniques that attackers can use to evade antivirus protection. This book is
a must-read for red teamers."
– Abhijit Mohanta, author of Malware analysis and Detection Engineering
and Preventing Ransomware
Contributors
About the authors
Nir Yehoshua is an Israeli security researcher with more than 8 years of experience in
several information security fields.
His specialties include vulnerability research, malware analysis, reverse engineering,
penetration testing, and incident response.
He is an alumnus of an elite security research and incident response team in the Israel
Defense Forces.
Today, Nir is a full-time bug bounty hunter and consults for Fortune 500 companies,
aiding them in detecting and preventing cyber-attacks.
Over the years, Nir has discovered security vulnerabilities in several companies, including
FACEIT, Bitdefender, McAfee, Intel, Bosch, and eScan Antivirus, who have mentioned
him in their Hall of Fame.
Special thanks to my mentor, Shay Rozen, for supporting this book in many
ways.
I've known Shay from my earliest days in the cybersecurity field and have
learned a lot from him about security research, cyber intelligence, and red
teaming. I can gladly say that Shay gave me the gift of the "hacker mindset,"
and for that I am grateful.
Thanks, Shay; I'm honored to know you.
Uriel Kosayev is an Israeli security researcher with over 8 years of experience in
the information security field. Uriel is also a lecturer who has developed courses in
the cybersecurity field. Uriel has hands-on experience in malware research, reverse
engineering, penetration testing, digital forensics, and incident response. During his army
service, Uriel worked to strengthen an elite incident response team in both practical and
methodological ways. Uriel is the founder of TRIOX Security, which today provides red
team and blue team security services along with custom-tailored security solutions.
Big thanks to Yaakov (Yaki) Ben-Nissan for all of these years, Yaki is a great
man with much passion and professionalism. These two characteristics
make him who he is: a true hero and a true mentor. To me, you are more
than just a mentor or teacher.
Thanks for being always there for me, with all my love and respect.
Reviewer
Andrey Polkovnichenko
Table of Contents
Preface
Section 1: Know the Antivirus – the Basics
Behind Your Security Solution
1
Introduction to the Security Landscape
Understanding the security Exploring protection systems 7
landscape 4 Antivirus – the basics 8
Defining malware 5 Antivirus bypass in a nutshell 11
Types of malware 6 Summary 13
2
Before Research Begins
Technical requirements 16 Working with Process Explorer 20
Getting started with the research 16 Working with Process Monitor 26
The work environment and lead Working with Autoruns 32
gathering 16 Working with Regshot 33
Process 17 Third-party engines 36
Thread 18
Summary 37
Registry 18
Defining a lead 20
viii Table of Contents
3
Antivirus Research Approaches
Understanding the approaches Insufficient permissions on the static
to antivirus research 40 signature file 47
Introducing the Windows Improper privileges 47
operating system 40
Unquoted Service Path 48
Understanding protection rings 42
DLL hijacking 49
Protection rings in the Windows
Buffer overflow 50
operating system 43
Stack-based buffer overflow 51
Windows access control list 45
Buffer overflow – antivirus bypass
Permission problems in approach 51
antivirus software 47
Summary 51
Section 2: Bypass the Antivirus – Practical
Techniques to Evade Antivirus Software
4
Bypassing the Dynamic Engine
Technical requirements 56 Classic DLL injection 71
The preparation 56 Process hollowing 72
Process doppelgänging 75
Basic tips for antivirus bypass research 57
Process injection used by threat actors 77
VirusTotal 58
Antivirus bypass using a DLL 81
VirusTotal alternatives 61
PE files 81
Antivirus bypass using process
PE file format structure 82
injection 63
The execution 83
What is process injection? 63
Windows API 66
Table of Contents ix
Antivirus bypass using timing- Memory bombing – large memory
based techniques 85 allocation 90
Windows API calls for antivirus bypass 85
Summary 95
Further reading 96
5
Bypassing the Static Engine
Technical requirements 98 Oligomorphic code 118
Antivirus bypass using Polymorphic code 118
obfuscation 98 Metamorphic code 120
Rename obfuscation 99 Antivirus bypass using packing 121
Control-flow obfuscation 104
How packers work 121
Introduction to YARA 105
The unpacking process 121
How YARA detects potential malware 105
Packers – false positives 140
How to bypass YARA 109
Summary 141
Antivirus bypass using
encryption 117
6
Other Antivirus Bypass Techniques
Technical requirements 144 Antivirus bypass using
Antivirus bypass using binary PowerShell 161
patching 144 Antivirus bypass using a single
malicious functionality 163
Introduction to debugging / reverse
engineering 144 The power of combining several
Timestomping 157 antivirus bypass techniques 168
An example of an executable before
Antivirus bypass using junk
and after peCloak 169
code 159