Pentera Labs researched techniques to bypass Antivirus and Endpoint Detection & Response by handling dependencies in fileless attacks. Using reflective loading, they ran tools like Mimikatz while evading Windows Defender by encrypting payloads until execution and loading DLLs from memory. Challenges included handling DLL forwarding and ApiSet redirections, which were solved by preloading DLLs and redirecting API imports. This allowed stealthy loading of unhooked DLL copies, bypassing EDR hooks. Suggested defenses include stronger memory scanning, syscall validation, randomized tables, mutexes in system DLLs, and moving ApiSet data to kernel mode.

Join for free to read