For years, reverse engineers and endpoint security software have used memory scanning to locate shellcode and malware implants in Windows memory. These tools rely on IOCs such as signatures and unbacked executable memory. This talk will dive into the various methods in which memory scanners search for these indicators and demonstrate a stable evasion technique for each method. A new position-independent reflective DLL loader, AceLdr, will be released alongside the presentation and features the demonstrated techniques to evade all of the previously described memory scanners. The presenter and their colleagues have used AceLdr on red team operations against mature security programs to avoid detection successfully.

https://x.com/vxunderground/status/1992173372474577065

Removing the driver via smss.exe

Someone asked me how to remove the AV/EDR driver because we were able to overwrite and delete the service, but the driver was impossible.

So, I tried some things and removed the driver by rebooting the host.

Open:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
And in the ExistingPageFiles parameter, enter the path to the AV/EDR driver (the beginning of the path is \??\C:\ or another disk label). Then reboot the machine and reap the benefits if smss.exe can gain uninstall permissions. For this reason, the effectiveness of this technique depends heavily on the architecture of the solution we're trying to remove.

Works on both Windows 10 and 11.

Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing manual mappers on GitHub and integrate one into your codebase. I’m not including one here, as AV vendors generally don’t appreciate that