Attack Tool(s): DLLHijackTest, PowerSploit, FaceDancer, PersistBOF
- DLLHijackTest: https://github.com/slyd0g/DLLHijackTest
- PowerSploit: https://github.com/PowerShellMafia/PowerSploit
- FaceDancer: https://github.com/usb-tools/FaceDancer
- PersistBOF: https://github.com/N4kedTurtle/PersistBOF
Detection Link(s):
- Endpoint Security Protection Analysis
- Memory Analysis
- Endpoint Security
Helpful Blogs (BHIS):
- “PowerShell Without PowerShell” – https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av – DLL hijacking context.
