Infiltr8: Red-Book

Infiltr8: Red-Book

Defense Evasion

Endpoint Detection Respons (EDR) Bypass

Bring Your Own Vulnerable Driver (BYOVD)Safe Mode With Networking Windows Defender Application Control (WDAC): Killing EDR Load Unsigned Drivers Minifilter Altitude Hypervisor Code Integrity (HVCI) Disallowed Images Windows Filtering Platform (WFP)Userland Hooking Bypass

Living Off The Land

Signature Evasion

AppLocker Bypass Mark-of-the-Web (MotW) Bypass PowerShell Constrained Language Mode (CLM) Bypass Kill Windows Defender

Virtualization-based security (VBS) Bypass

Sandbox Evasion

Privilege Escalation

Credential Access

Lateral Movement

Red-TeamingDefense Evasion

Endpoint Detection Respons (EDR) Bypass

Bring Your Own Vulnerable Driver (BYOVD)MITRE ATT&CK™ Exploitation for Privilege Escalation - Technique T1068 Hypervisor Code Integrity (HVCI) Disallowed ImagesWIP Load Unsigned DriversWIP Minifilter AltitudeWIP Safe Mode With NetworkingMITRE ATT&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001 Userland Hooking BypassWIP Windows Defender Application Control (WDAC): Killing EDRMITRE ATT&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001 Windows Filtering Platform (WFP)WIP

Defense Evasion

MITRE ATT&CK™ Defense Evasion - Tactic TA0005

Bring Your Own Vulnerable Driver (BYOVD)

MITRE ATT&CK™ Exploitation for Privilege Escalation - Technique T1068