{"id":4334,"date":"2017-10-04T21:56:31","date_gmt":"2017-10-04T21:56:31","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4334"},"modified":"2018-03-25T18:53:37","modified_gmt":"2018-03-25T18:53:37","slug":"running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-2","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/10\/04\/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-2\/","title":{"rendered":"Running programs via Proxy & jumping on a EDR-bypass trampoline, Part 2"},"content":{"rendered":"

Update<\/strong><\/p>\n

After my post Zod<\/a> contacted me with this mike-dropping link: Ultimate AppLocker ByPass List<\/a>. Really lots of good stuff there! Thx Zod!<\/p>\n

Old Post<\/strong><\/p>\n

In the first part<\/a> I listed a couple of examples of programs that may be used as a proxy to launch other programs. In the meantime, subTee<\/a> kicked off a very interesting thread<\/a> on Twitter listing a number of signed .exe binaries that can be used as a proxy to load a DLL. Yesterday I came across a few cool posts by @0rbz_<\/a>. This in return reminded me of my first post and I decided to add a few more proxy\/living off the land ideas.<\/p>\n

There is a number of signed .exe that can be used to load other .exes or .dlls and as a result – break standard EDR detection rules, or bypass some whitelisting. This may sometimes involve copying the signed binary to your folder in order to sideload your DLL (PlugX is a very good example, funnily enough – in many cases they don’t even need to bring a signed .exe and fetch one that is typically present on the system).<\/p>\n

Here is the list:<\/p>\n