# Hooking

Published articles for Hooking.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Attacking Smart Card Based Active Directory Networks

DevFeed: [Attacking Smart Card Based Active Directory Networks](<https://devfeed.tech/articles/attacking-smart-card-based-active-directory-networks-32631.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/10/04/attacking-smart-card-based-active-directory-networks/>)

Author: CCob

Published: 2020-10-04T19:31:42Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [active directory](<https://devfeed.tech/topics/active-directory.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [private key](<https://devfeed.tech/topics/private-key.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [kerberos](<https://devfeed.tech/topics/kerberos.md>), [public key](<https://devfeed.tech/topics/public-key.md>)

Tags: [active-directory](<https://devfeed.tech/tags/active-directory.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [pin](<https://devfeed.tech/tags/pin.md>), [pinswipe](<https://devfeed.tech/tags/pinswipe.md>), [pki](<https://devfeed.tech/tags/pki.md>), [private-key](<https://devfeed.tech/tags/private-key.md>), [public-key](<https://devfeed.tech/tags/public-key.md>), [rubeus](<https://devfeed.tech/tags/rubeus.md>), [smart-card](<https://devfeed.tech/tags/smart-card.md>), [swipe](<https://devfeed.tech/tags/swipe.md>), [weaponize](<https://devfeed.tech/tags/weaponize.md>)

### AI overview

This article examines attacks against smart-card-enforced Active Directory networks. It explains that a physical smart card is not necessarily required for smart-card logon when the corresponding private key is available, describes certificate requirements and policy-related certificate abuse, and introduces PKINIT as public-key support for Kerberos pre-authentication.

### Source excerpt

Introduction Recently I was involved in an engagement where I was attacking smart card based Active Directory networks. The fact is though, you don't need a physical smart card at all to authenticate to Active Directory that enforces smart card logon. The attributes of the certificate determine if it can be used for smart card [...] The post Attacking Smart Card Based Active Directory Networks appeared first on Ethical Chaos.

## EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls

DevFeed: [EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-2-32630.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/06/14/lets-create-an-edr-and-bypass-it-part-2/>)

Author: CCob

Published: 2020-06-14T10:47:09Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Code](<https://devfeed.tech/topics/code.md>), [API](<https://devfeed.tech/topics/api.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [boilerplate](<https://devfeed.tech/tags/boilerplate.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [code](<https://devfeed.tech/tags/code.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [process](<https://devfeed.tech/tags/process.md>), [sharpblock](<https://devfeed.tech/tags/sharpblock.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>)

### AI overview

This tutorial examines methods for bypassing an active-protection EDR, including avoiding suspicious RWX memory changes, unhooking API calls, and using direct syscall instructions. It also introduces SharpBlock and accompanying code.

### Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part 2 I introduce SharpBlock, a method of bypassing EDR's. The post Lets Create An EDR... And Bypass It! Part 2 appeared first on Ethical Chaos.

## Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)

DevFeed: [Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-1-32629.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/05/27/lets-create-an-edr-and-bypass-it-part-1/>)

Author: CCob

Published: 2020-05-27T18:50:50Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [virtual machines](<https://devfeed.tech/topics/virtual-machines.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [binaries](<https://devfeed.tech/tags/binaries.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [implementation](<https://devfeed.tech/tags/implementation.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [malware](<https://devfeed.tech/tags/malware.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>), [virtual-machines](<https://devfeed.tech/tags/virtual-machines.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

Part one explains how a basic EDR detects malicious files and behavior through signature detection, kernel-level file system filters, sandboxing, and dynamic analysis. It also introduces sandbox bypass concepts involving analysis time limits and disrupted control flow.

### Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part one we cover how to create a basic EDR. The post Lets Create An EDR... And Bypass It! Part 1 appeared first on Ethical Chaos.

## Having a look at the Windows' User/Kernel exceptions dispatcher

DevFeed: [Having a look at the Windows' User/Kernel exceptions dispatcher](<https://devfeed.tech/articles/having-a-look-at-the-windows-user-kernel-exceptions-dispatcher-39692.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2013/10/12/having-a-look-at-the-windows-userkernel-exceptions-dispatcher/>)

Author: Axel "0vercl0k" Souchet

Published: 2013-10-12T21:03:00Z

Content type: tutorial

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Exception](<https://devfeed.tech/topics/exception.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [x86](<https://devfeed.tech/topics/x86.md>), [Assembly](<https://devfeed.tech/topics/assembly.md>)

Tags: [coding](<https://devfeed.tech/tags/coding.md>), [cpu](<https://devfeed.tech/tags/cpu.md>), [exception](<https://devfeed.tech/tags/exception.md>), [exceptions](<https://devfeed.tech/tags/exceptions.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [interrupt](<https://devfeed.tech/tags/interrupt.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [process](<https://devfeed.tech/tags/process.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [seh](<https://devfeed.tech/tags/seh.md>), [windows](<https://devfeed.tech/tags/windows.md>), [windows-internals](<https://devfeed.tech/tags/windows-internals.md>)

### AI overview

This article explains how Windows user- and kernel-mode exception dispatch works on Windows 7 x86. It also describes creating a userland proof of concept that monitors process exceptions and generates reports, including hooking ntdll!KiUserExceptionDispatcher with Detours.

### Source excerpt

Introduction The purpose of this little post is to create a piece of code able to monitor exceptions raised in a process (a bit like gynvael's ExcpHook but in userland), and to generate a report with information related to the exception. The other purpose is to have a look ...