search

optiv / ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.
2.71k stars 503 forks source link

Windows defender catches ScareCrow generated payload #30

Closed Morronel closed 2 years ago

Morronel commented 2 years ago

I created stageless meterpreter with msfvenom, then packed it as exe file with scarecrow, and windows defender is catching my exe file. Am I doing something wrong, or is ScareCrow already out of date?

Kind regards, Zahar

Tylous commented 2 years ago

Hello,

So first of all Scarecrow is very much still current and works against pretty much all userland-based EDRs (and many kernel-based), Windows Defender doesn't rely on userland hooks (it uses stuff in the kernel, AMSI, and other stuff), as a result, once it decrypts the shellcode in memory it's in a raw state. Msfvenom's shellcode is highly IoC'ed and therefore is easy to detect. (I discuss a lot of this in my Defcon talk One of the big points I discuss in this talk is that binaries by default are very dirty and alternative loaders are better. I also talk about how it's important to look at how your shellcode and traffic look to ensure it's unique, making it harder to make a signature for it. I am currently working on an update with some new features that will make binaries easy to use again against Defender and other EDR products that don't use userland hooks.

Morronel commented 2 years ago

Thank you very much for such a quick answer! I'll be glad to test it when update is ready