Lets Go Around Defender with NativeDump

[@ohmsohmsohms]

Another banger, starting out in pentesting/redteaming and ur really helping my methodology man. God bless you

[@CyberAttackDefense]

Glad my content is helping. Thanks for watching!

[@BestITintelligence]

Allways the BEST!!!!

[@CyberAttackDefense]

Thank you! Glad you like it.

[@ryanpinga]

excellent rundown! keep them coming!

[@CyberAttackDefense]

Thanks! Will do. Anything in particular you want to see?

[@ferassami3362]

Can you share your experience with the protected process concept RunAsPPl , even Native Dump cant work with it

[@CyberAttackDefense]

Ah RunAsPPL is only a good step where you can’t use credential guard. It can be defeated with rogue drivers. Mimikatz has a feature to unprotect a process by using !processprotect this does require the mimidrv.sys. If you cripple Defender or other EDR protected processes can be reversed.

[@neotokyo98]

could u do a video on coff loader using it to do a threadless injectio and bypassing defender dont know if itll get flagged but was curious to see how itll pan out

[@CyberAttackDefense]

Last time I tried coff loader it got caught but sure. I can give it a shot.

[@neotokyo98]

@@CyberAttackDefense ya give it a shot i wanted to see how itll work