Book Image

Antivirus Bypass Techniques

By : Nir Yehoshua, Uriel Kosayev
Book Image

Antivirus Bypass Techniques

By: Nir Yehoshua, Uriel Kosayev

Overview of this book

Antivirus software is built to detect, prevent, and remove malware from systems, but this does not guarantee the security of your antivirus solution as certain changes can trick the antivirus and pose a risk for users. This book will help you to gain a basic understanding of antivirus software and take you through a series of antivirus bypass techniques that will enable you to bypass antivirus solutions. The book starts by introducing you to the cybersecurity landscape, focusing on cyber threats, malware, and more. You will learn how to collect leads to research antivirus and explore the two common bypass approaches used by the authors. Once you’ve covered the essentials of antivirus research and bypassing, you'll get hands-on with bypassing antivirus software using obfuscation, encryption, packing, PowerShell, and more. Toward the end, the book covers security improvement recommendations, useful for both antivirus vendors as well as for developers to help strengthen the security and malware detection capabilities of antivirus software. By the end of this security book, you'll have a better understanding of antivirus software and be able to confidently bypass antivirus software.
Table of Contents (13 chapters)
1
Section 1: Know the Antivirus – the Basics Behind Your Security Solution
5
Section 2: Bypass the Antivirus – Practical Techniques to Evade Antivirus Software
9
Section 3: Using Bypass Techniques in the Real World

Fingerprinting antivirus software

Antivirus fingerprinting is a process of searching and identifying antivirus software in a target endpoint based on identifiable constants, such as the following:

  • Service names
  • Process names
  • Domain names
  • Registry keys
  • Filesystem artifacts

The following table will help you perform fingerprinting of antivirus software on the endpoint by the service and process names of the antivirus software:

Table 7.1 – Antivirus processes and services

Table 7.1 – Antivirus processes and services

Note

You do not have to rely only on process and service names—you can also rely on registry names, and more. We recommend that you visit the Antivirus-Artifacts project at https://github.com/D3VI5H4/Antivirus-Artifacts to find out more about this.

We can perform fingerprinting on a simple Python script, for instance, which will monitor all processes running on the operating system and compare predetermined strings.

For example, let&apos...