admin2879 / busysleepbeacon Goto Github PK

View Code? Open in Web Editor NEW

This is a simple project made to evade https://github.com/thefLink/Hunt-Sleeping-Beacons by using a busy wait instead of beacon's built in Sleep() call. Most of the structure e.g. Sleep hook, shellcode exec etc. are taken from mgeeky's https://github.com/mgeeky/ShellcodeFluctuation.

C++ 100.00%

busysleepbeacon's Introduction

BusySleepBeacon

This is a simple project made to evade https://github.com/thefLink/Hunt-Sleeping-Beacons by using a busy wait instead of beacon's built in Sleep() call.
Most of the structure e.g. Sleep hook, shellcode exec etc. are taken from mgeeky's https://github.com/mgeeky/ShellcodeFluctuation.

How it works

A userland hook is applied to the Sleep() function called by beacon
Beacon calls Sleep() to sleep
The hook redirects execution to our sleep function
Our sleep function performs the sleep using a busy wait
Execution is passed back to the beacon shellcode

This way, we intercept and replace the Sleep() call with our busy wait function, preventing the thread from entering the DelayExecution state.
There is a possible OPSEC implication of this implementation in that it uses considerably more CPU than a normal beacon. Be aware of that.

Usage

Use busy sleep

BusySleepBeacon.exe ./beacon.bin 1

No busy sleep

BusySleepBeacon.exe ./beacon.bin 0

Test detection

Hunt-Sleeping-Beacons.exe

Expected results:

Recommend Projects

admin2879 / busysleepbeacon Goto Github PK