Process Name Blacklisting
Process Masquerading
Sometimes certain processes are being identified by process name and killed.
Blocklists on filenames as a defensive measure can be bypassed by making a copy of a binary and give it a different name.
For example, renaming netcat.exe to notepad.exe or a legitimate business process name will bypass the simple name check.
Start a reverse shell
Last updated