Antivirus Evasion - Process Injection and Migration

Master the art of process injection and process migration with this in-depth course, crucial for understanding sophisticated malware behavior and bolstering your penetration testing skills. Learn how attackers leverage these techniques to execute malicious code, circumvent security defenses, and avoid detection.

This course delves into a wide array of key techniques, including:

• Classic Process Injection: A foundational method for injecting code into running processes.
• Process Hollowing: A stealthy technique to replace legitimate process code with malicious code.
• Unhooking AV Hooks: Bypassing antivirus detection by removing antivirus integration points.
• Unhooking AV ntdll.dll using PerunsFart: A specific method for evading antivirus detection by manipulating the ntdll.dll library.

You'll explore advanced concepts like:

• Section Mapping: Manipulating memory regions for covert code execution.
• Thread Context Manipulation: Hijacking thread execution to execute malicious code within a target process.
• Asynchronous Procedure Calls (APCs): Queuing code execution within a target process for stealthy operations.

Gain practical experience through hands-on labs and real-world case studies. Understand how these techniques are employed in actual attacks and develop effective defensive strategies. We'll cover:

• Behavioral Monitoring: Detecting malicious activity based on process behavior.
• Memory Analysis: Examining process memory for signs of compromise.
• Advanced Endpoint Detection and Response (EDR) Systems: Utilizing modern tools for threat detection and response.

This course equips you with the knowledge to not only understand the offensive use of process injection and process migration, but also to effectively defend against these advanced attack methods.

Prerequisites: A solid foundation in operating systems, programming concepts, and general cybersecurity principles is recommended.