search

C5Hackr / Phantom

61 stars 13 forks source link

UAC Bypass #3

Closed axlalixx closed 7 months ago

axlalixx commented 7 months ago

I have noticed enabling UAC Bypass makes the script detected, I have tried it on multiple programs and it just makes the whole script detected when its ran. I dont mean to be an asshole btw.

C5Hackr commented 7 months ago

This is because I'm using mock directories, which requires a custom DLL to be dropped, this DLL is detected and I have no means to make it undetected, however it can be done quite easily with slight modifications, however that is for scantime, runtime is a different story as most AV's have a behavior ruleset that detect the mock directory UAC Bypass method. :)