I bet this plays havoc with the vast majority of EDRs. I can think of a few ways to go about detecting this, I look forward to the defensive counter blog posthttps://twitter.com/_batsec_/status/1405491567369101316 …
-
I dunno if this actually less sneaky if your going to use Images from disk since a reflective loader would still cause a bunch of CreateFile(). In practice EDRs have a terrible time disambiguating legit JIT from reflective and this approach makes that more practical to use imo
Ive already told him how to run exe files with the content being generated programmatic as read without actually ever touching disk. Guess its first in next release then....
