Book Image

Antivirus Bypass Techniques

By : Nir Yehoshua, Uriel Kosayev
Book Image

Antivirus Bypass Techniques

By: Nir Yehoshua, Uriel Kosayev

Overview of this book

Antivirus software is built to detect, prevent, and remove malware from systems, but this does not guarantee the security of your antivirus solution as certain changes can trick the antivirus and pose a risk for users. This book will help you to gain a basic understanding of antivirus software and take you through a series of antivirus bypass techniques that will enable you to bypass antivirus solutions. The book starts by introducing you to the cybersecurity landscape, focusing on cyber threats, malware, and more. You will learn how to collect leads to research antivirus and explore the two common bypass approaches used by the authors. Once you’ve covered the essentials of antivirus research and bypassing, you'll get hands-on with bypassing antivirus software using obfuscation, encryption, packing, PowerShell, and more. Toward the end, the book covers security improvement recommendations, useful for both antivirus vendors as well as for developers to help strengthen the security and malware detection capabilities of antivirus software. By the end of this security book, you'll have a better understanding of antivirus software and be able to confidently bypass antivirus software.

Related Content you might be interested in

Current Title:

Small book image
Antivirus Bypass Techniques
Nir Yehoshua | Uriel Kosayev
Jul, 2021 | 242 pages
Small book image
Malware Analysis Techniques
Dylan Barker
Jun, 2021 | 282 pages
Small book image
Mastering Reverse Engineering
Reginald Wong
Oct, 2018 | 436 pages
Small book image
Mastering Malware Analysis
Alexey Kleymenov | Amr Thabet
Sep, 2022 | 572 pages
Table of Contents (13 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Code in Action
Download the color images
Conventions used
Disclaimer
Get in touch
Reviews
1
Section 1: Know the Antivirus – the Basics Behind Your Security Solution
Section 1: Know the Antivirus – the Basics Behind Your Security Solution
Free Chapter
2
Chapter 1: Introduction to the Security Landscape
Chapter 1: Introduction to the Security Landscape
Understanding the security landscape
Defining malware
Exploring protection systems
Antivirus – the basics
Antivirus bypass in a nutshell
Summary
3
Chapter 2: Before Research Begins
Chapter 2: Before Research Begins
Technical requirements
Getting started with the research
The work environment and lead gathering
Defining a lead
Working with Process Explorer
Working with Process Monitor
Working with Autoruns
Working with Regshot
Third-party engines
Summary
4
Chapter 3: Antivirus Research Approaches
Chapter 3: Antivirus Research Approaches
Understanding the approaches to antivirus research
Introducing the Windows operating system
Understanding protection rings
Protection rings in the Windows operating system
Windows access control list
Permission problems in antivirus software
Unquoted Service Path
DLL hijacking
Buffer overflow
Summary
5
Section 2: Bypass the Antivirus – Practical Techniques to Evade Antivirus Software
Section 2: Bypass the Antivirus – Practical Techniques to Evade Antivirus Software
6
Chapter 4: Bypassing the Dynamic Engine
Chapter 4: Bypassing the Dynamic Engine
Technical requirements
The preparation
VirusTotal
VirusTotal alternatives
Antivirus bypass using process injection
Antivirus bypass using a DLL
Antivirus bypass using timing-based techniques
Summary
Further reading
7
Chapter 5: Bypassing the Static Engine
Chapter 5: Bypassing the Static Engine
Technical requirements
Antivirus bypass using obfuscation
Antivirus bypass using encryption
Antivirus bypass using packing
Summary
8
Chapter 6: Other Antivirus Bypass Techniques
Chapter 6: Other Antivirus Bypass Techniques
Technical requirements
Antivirus bypass using binary patching
Antivirus bypass using junk code
Antivirus bypass using PowerShell
Antivirus bypass using a single malicious functionality
The power of combining several antivirus bypass techniques
Antivirus engines that we have bypassed in our research
Summary
Further reading
9
Section 3: Using Bypass Techniques in the Real World
Section 3: Using Bypass Techniques in the Real World
10
Chapter 7: Antivirus Bypass Techniques in Red Team Operations
Chapter 7: Antivirus Bypass Techniques in Red Team Operations
Technical requirements
What is a red team operation?
Bypassing antivirus software in red team operations
Fingerprinting antivirus software
Summary
11
Chapter 8: Best Practices and Recommendations
Chapter 8: Best Practices and Recommendations
Technical requirements
Avoiding antivirus bypass dedicated vulnerabilities
Improving antivirus detection
Secure coding recommendations
Summary
Why subscribe?
12
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Leave a review - let other readers know what you think

Chapter 1: Introduction to the Security Landscape

This chapter provides an overview of our connected world. Specifically, it looks at how cybercriminals in the cyber landscape are becoming more sophisticated and dangerous. It looks at how they abuse the worldwide connectivity between people and technology. In recent years, the damage from cyberattacks has become increasingly destructive and the majority of the population actually thinks that antivirus software will protect them from all kinds of cyber threats. Of course, this is not true and there are always security aspects that need to be dealt with in order to improve antivirus software's overall security and detections.

Many people and organizations believe that if they have antivirus software installed on their endpoints, they are totally protected. However, in this book, we will demonstrate – based on our original research of several antivirus products – why this is not completely true. In this book, we will describe the types of antivirus engines on the market, explore how antivirus software deals with threats, demonstrate the ways in which antivirus software can be bypassed, and much more.

In this chapter, we will explore the following topics:

  • Defining malware and its types
  • Exploring protection systems
  • Antivirus – the basics
  • Antivirus bypass in a nutshell
Previous Section
End of Section 1
Next Section