Creating Payloads with ScareCrow to Mimic Reputable Sources and Bypass Anti-Virus

This write-up discusses using ScareCrow to create payload frameworks for side loading (not injecting) into a legitimate Windows process, bypassing Application Whitelisting controls.

After loading the DLL loader into memory, a technique is employed to flush an Endpoint Detection & Response (EDR) hook out of the system DLLs running in the process’s memory. This technique is successful because it is known that the EDR’s hooks are placed when a process is launched.

ScareCrow can target and manipulate DLLs in memory …

hacker hacking hacking tools linux penetration testing