search

klezVirus / inceptor

Template-Driven AV/EDR Evasion Framework
Other
1.6k stars 263 forks source link

[ERROR] Module etw was not found #30

Closed majid-derkaoui closed 2 years ago

majid-derkaoui commented 2 years ago

▒ by d3adc0de (@klezVirus)

[ERROR] Module etw was not found [*] Multiple compatible templates identified, choose one: 0: assembly_load.cs 1: classic.cs 2: service.cs $>

klezVirus commented 2 years ago

Sorry for the delay in getting back, there is no module named ETW, atm. Anything is wrapped in the amsi bypass module. in the config.ini file, you can find the following:

[MISC]
logo = 0
bypass_mode = 100
release = public

Were 100 means only AMSI is disable, 010 means WLDP is disabled, and 001 means ETW is disabled.

001: Patch ETW
010: Patch WLDP
100: Patch AMSI
011: Patch WLDP + ETW
101: Patch AMSI + ETW
110: Patch AMSI + WLDP
111: Patch AMSI + WLDP + ETW

Sorry for the strange implementation, I'm working on changing it.