You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
No
##A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
First off, I love the project..
The default assembly names for the initial loader aka "dropper_cs" requires external customisation to modify. This dropper_cs assembly name is also present in the full implant which includes AMSI and ETW bypass in the bootstrap.
When serious blue teams are doing IR this becomes a OPSEC concern.
ETW is blocking a good job blocking the assembly names "for now" however deeper offline forensics will eventually reveal the glaring standout default assembly names.
Describe the solution you'd like
Add assembly name ##REPLACEME## functionality as with the other variables in config.yaml
Describe alternatives you've considered
Modifying binaries in dnSPy, recompiling core source and decompiling implants in IDA.
Additional context
NA
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
No
##A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
First off, I love the project..
The default assembly names for the initial loader aka "dropper_cs" requires external customisation to modify. This dropper_cs assembly name is also present in the full implant which includes AMSI and ETW bypass in the bootstrap.
When serious blue teams are doing IR this becomes a OPSEC concern.
ETW is blocking a good job blocking the assembly names "for now" however deeper offline forensics will eventually reveal the glaring standout default assembly names.
Describe the solution you'd like
Add assembly name ##REPLACEME## functionality as with the other variables in config.yaml
Describe alternatives you've considered
Modifying binaries in dnSPy, recompiling core source and decompiling implants in IDA.
Additional context
NA
The text was updated successfully, but these errors were encountered: