Skip to content

Commit 25153d7

Browse files
committed
readme
1 parent 332eaf7 commit 25153d7

File tree

1 file changed

+2
-5
lines changed

1 file changed

+2
-5
lines changed

README.md

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,9 @@ A PoC implementation for an advanced in-memory evasion technique that spoofs Thr
77
This is an example implementation for _Thread Stack Spoofing_ technique aiming to evade Malware Analysts, AVs and EDRs looking for references to shellcode's frames in an examined thread's call stack.
88
The idea is to walk back thread's call stack and overwrite return addresses in subsequent function frames thus masquerading allocations containing malware's code.
99

10-
An implementation may differ, however the idea is roughly similar to what [MDSec's Nighthawk C2](https://www.mdsec.co.uk/nighthawk/) offers for its agents.
11-
Especially demonstrated in this video:
10+
An implementation may differ, however the idea is roughly similar to what commercial C2 frameworks offer for its agents.
1211

13-
[Nighthawk - Thread Stack Spoofing](https://vimeo.com/581861665)
14-
15-
This implementation along with my [ShellcodeFluctuation](https://github.com/mgeeky/ShellcodeFluctuation) brings Offensive Security community sample implementations to catch up on the offering made by commercial C2 products, so that we can do no worse in our Red Team toolings. 💪
12+
Implementation along with my [ShellcodeFluctuation](https://github.com/mgeeky/ShellcodeFluctuation) brings Offensive Security community sample implementations to catch up on the offering made by commercial C2 products, so that we can do no worse in our Red Team toolings. 💪
1613

1714

1815
## How it works?

0 commit comments

Comments
 (0)