Section 17: Detection Avoidance

Question 1

Command to create a windows user and add it to an admin group

Answer 1

net user /add hacked Hacked123

net localgroup administrators hacked /add

Question 2

Code Injection

Answer 2

Exploit technique that runs malicious code with the identification number of a legitimate process

Question 3

Masquerading

Answer 3

Occurs when the dropper replaces a genuine executable with a malicious one

Question 4

Stream Editor (SED)

Answer 4

Has the ability to search, find, delete, replace, insert, or edit anything inside of a file without the need to open that file
▪ sed -i ‘malware’ /var/log/auth.log

Question 5

Commands to erase history

Answer 5

Bash (erase history)
● echo “ ” > ~.bash_history
history -c

PowerShell
● Clear-History

Question 6

Empire

Answer 6

A C2 framework that uses PowerShell for common post exploitation tasks
▪ github.com/bc-security/empire
▪ Nowadays, most Empire tools and techniques can be detected by
antivirus tools

Question 7

BloodHound

Answer 7

A tool used to explore Active Directory trust relationships and abuse rights on AD objects