Summary

This chapter covered several crucial techniques, strategies, and modern reaction correspondences that have occurred in the information security space in recent years. We saw how offensive operations have evolved to avoid artifacts that traditional dead disk forensics would investigate. The offensive shift to memory operations also brought about a defensive shift to new EDR platforms, which could inspect process memory and create richer security event signaling. We also did a deep dive on the CreateRemoteThread process injection technique, showing how to implement it in Go, and how it is implemented in many popular frameworks, such as Metasploit. We examined position-independent shellcode, the properties that make this critical for process injection and how to generate arbitrary shellcode. We looked at EternalBlue and getting a Meterpreter shell with this exploit. We walked through generating position-independent shellcode from a Sliver agent. Later, we chained many of these...