In yesterday's meeting, we did a deep dive into the architecture and development of Command and Control (C2) implants, specifically focusing on Windows usermode environments. The session covered the core components of C2 infrastructure, common defensive mechanisms, and the advanced evasion techniques required to stay undetected by Endpoint Detection and Response (EDR) solutions.

Introduction to C2 and Implants

C2 refers to an infrastructure that allows an operator to control software on a compromised machine. We explored different architectures, from simple monolithic setups to complex client-server models used by frameworks like Cobalt Strike, Sliver, and Havoc. Building custom implants can be used as a way to better understand detection bypasses, not as incentive to perform malicious tasks.

Detection and Evasion

A significant portion of the meeting focused on how defenders identify malicious activity:

• •Static Detection: Analyzing PE files for suspicious strings, import tables (e.g., VirtualAllocEx, CreateRemoteThread), and high entropy indicative of packing or encryption.
• •Usermode Hooks: How EDRs intercept Win32 and Native API calls by placing "jumps" in ntdll.dll to log arguments and block suspicious actions.
• •Kernel-Level Detection: Utilizing callbacks like PsSetCreateProcessNotifyRoutine and PsSetCreateThreadNotifyRoutine that cannot be easily unhooked from usermode.
• •ETW and AMSI: Windows features for event tracing and antimalware scanning that implants must often patch or "blind" to remain hidden.

Evasion Techniques

To counter these defenses, we examined Windows Internals Essentials, specifically the layers of the Windows API from Win32 down to ntdll.dll and syscalls. Key evasion techniques discussed included:

• •Direct and Indirect Syscalls: Bypassing EDR hooks by manually executing syscall instructions or jumping to them within ntdll.dll to make the stack look legitimate.
• •API Hashing: Eliminating suspicious strings from the binary by using hashes (e.g., djb2) to resolve function addresses at runtime.
• •Sleep Obfuscation: Encrypting the implant's memory and removing execute permissions while it is "sleeping" to avoid detection by memory scanners.

Implant Architecture

We detailed the Implant Skeleton and Bootstrap Sequence, emphasizing a specific order of operations: setting up a safety net (VEH), unhooking ntdll.dll, blinding monitors (ETW/AMSI), preparing the payload, and finally entering the Beacon Loop. This loop manages the implant's check-in frequency, task execution, and result reporting.

COFF Loaders (BOFs)

Finally, we touched on COFF Loaders (BOFs), which allow implants to be extended with new capabilities (like SAM dumping or custom recon) without needing to redeploy the entire binary. This "in-process" execution provides a stealthy way to run modular code on a target.