dropengine: A Malleable Payload Creation Framework for EDR Evasion
Gabriel Ryan introduces DropEngine, a modular framework for generating polymorphic, malleable shellcode runners designed to evade modern EDR solutions.
Summary
The High Attrition Rate of Initial Access Payloads
Modern Endpoint Detection and Response (EDR) solutions use automated static analysis, dynamic heuristics, and AMSI scanning to detect standard shellcode runners.
Introducing the DropEngine Modular Framework
Gabriel Ryan presents DropEngine, an extensible framework that decouples payload creation into swappable encrypters, decrypters, execution methods, and bypasses.
Implementing Advanced Process Injection and Unhooking
Ryan demonstrates configuring custom payload profiles—incorporating AMSI/ETW patching, direct syscall invocations, and stealthy memory allocation routines.
Detection Engineering for Polymorphic Shellcode Runners
The author discusses behavioral indicators, memory scanning heuristics, and kernel-mode telemetry necessary for defenders to catch malleable loaders.
Related talks
Red Team Village·1 hr
Eduardo Arriols
Eduardo Arriols breaks down stealthy backdoor deployment and persistent access techniques across enterprise Windows networks, evading blue team hunts.
Hack In The Box Security Conference·1 hr 2 min
Jorge Gimenez · Karsten Nohl
Jorge Gimenez investigates #HITB2022SIN EDR Evasion Primer For Red Teamers.
Main Stage·39 min
Helvio Carvalho Junior
HookChain technique for dynamically altering API call sequences and hooking mechanics to bypass EDR telemetry in memory.