How to bypass Microsoft Defender SmartScreen?

[surruptor]

How can i bypass Microsoft Defender SmartScreen, to not flag my executable. currently when trying to run the payload executable. we see the warning message.

Windows protected your PC

Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.


Is there a way to maybe copy a code signature from a already trusted software. or obtain one myself remaining completely anonymous, and without analysis of my code.
Or perhaps any other tried and tested methods.

 

[Бафомет]

DLL sideload technique is what you looking for, there are multiple examples all over the internet.

https://attack.mitre.org/techniques/T1574/002/

https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dll-hijacking

https://www.ired.team/offensive-security/persistence/dll-proxying-for-persistence

https://posts.redteamtacticsacademy...g-with-fixmapi-exe-for-red-teams-23d0416b89ca

https://posts.redteamtacticsacademy...xe-for-red-teams-23d0416b89ca?gi=f10888a48ff6

https://www.redteam.cafe/red-team/dll-sideloading/dll-sideloading-not-by-dllmain

https://silentk0i.substack.com/p/discovering-binaries-for-dll-sideloading

PD: Do not use PE executables. Try to avoid them.

 

[surruptor]

DLL sideload technique is what you looking for, there are multiple examples all over the internet.

https://attack.mitre.org/techniques/T1574/002/

https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dll-hijacking

https://www.ired.team/offensive-security/persistence/dll-proxying-for-persistence

https://posts.redteamtacticsacademy...g-with-fixmapi-exe-for-red-teams-23d0416b89ca

https://posts.redteamtacticsacademy...xe-for-red-teams-23d0416b89ca?gi=f10888a48ff6

https://www.redteam.cafe/red-team/dll-sideloading/dll-sideloading-not-by-dllmain

https://silentk0i.substack.com/p/discovering-binaries-for-dll-sideloading

PD: Do not use PE executables. Try to avoid them.

Thank you Brother, i will look into using DLL sideloading. also whats the way to compile the payload if not a PE executable.

 

[Lipshitz]

Some c2s have the option for output. Otherwise probably best bet is to use donut or similar to make your exe to shellcode and then use a dll as stager to launch

 

[bg1]

Thank you Brother, i will look into using DLL sideloading. also whats the way to compile the payload if not a PE executable.

Correct , i used dll side loading before with adobe photoshop and premier to deliver my payloads and works also i suggest to make the dll drop .vbs script and the vbs script do the job

 

[pierre777reborn]

Correct , i used dll side loading before with adobe photoshop and premier to deliver my payloads and works also i suggest to make the dll drop .vbs script and the vbs script do the job

what are you using now

 

[bg1]

what are you using now

what do you mean ?

 

[pierre777reborn]

what do you mean ?

come pm