Ethical Hacking Endpoint Protection Evasion

The Ethical Hacking Endpoint Protection Evasion (EHEPE) course presents offensive evasion techniques, analyzing the stages of developing code and tools capable of bypassing defense systems, as well as studying shellcode execution mechanisms in hardened corporate environments.

Millions of dollars are spent by companies on Antivirus, Endpoint Detection and Response (EDR), and monitoring solutions; however, most of these controls are circumvented by Advanced Persistent Threats (APT) that often employ customized Tactics, Techniques, and Procedures (TTP), causing the entire protection chain that was purchased and configured to be bypassed.

How do attackers manage to execute malicious code even with protections enabled and up to date? How do they move within a network without triggering alerts in detection systems? How do they manage to circumvent protections such as AppLocker, Sysmon, ETW, LAPS, CLM, among others, and succeed in propagating malware within a corporate network? How do they use other channels for data exfiltration and not get caught? These and other questions will be answered in this training, which takes a 100% hands-on approach, driven by labs and exercises that will enable students to understand in detail the topics mentioned.

The course covers current antivirus evasion and hardening techniques in up-to-date environments. It will present attack TTPs, as well as the development of other tools for executing malicious code, from the simplest to techniques used by APTs—fundamental points for both offensive activities (Pentesters, Red Team) and defensive activities (Blue Team, Threat Hunting, CSIRT, SOC).

Several topics will be addressed, such as: understanding antivirus, evasion of signature-based detections, evasion of heuristic detections, P/Invoke, D/Invoke, Reflection, development of shellcode runners/malware, obfuscation, AppLocker evasion, LAPS evasion, AppLocker evasion, stealthy lateral movement, AMSI evasion, among others.