Kaspersky Evasion — 22nd Survey Division

$ Get-Process | Where-Object { $_.Name -like '*avp*' } | Select-Object Name, Id

Name Id ---- -- avp 5612 avp 11692 avpui 16084

Three Kaspersky processes active on .92 — real-world target with live AV. STATUS: Process list verified live. System Watcher behavior is theoretical pending trigger test.

$ Get-Process | Where-Object { $_.Name -like '*avp*' -or $_.Name -like '*kaspersky*' } | Select-Object Name, Id, Path

Name Id Path ---- -- ---- avp 5612 avp 11692 avpui 16084

avp.exe = main AV engine (x2 for redundancy). avpui.exe = user interface.

$ # Kaspersky defense layers: # 1. Static signatures (file hash + byte patterns) # 2. Heuristic analysis (behavioral patterns in code) # 3. System Watcher (rollback on suspicious behavior) # 4. KSN (cloud hash lookup + reputation)

Defense-in-depth: 4 layers Layer 1: Static — signature database, heuristic rules Layer 2: Behavioral — emulator runs code in sandbox Layer 3: System Watcher — monitors file/registry changes, rolls back if threat detected Layer 4: KSN — cloud hash lookup, reputation scoring

Ghost FUD beats Layer 1. Dark Room beats Layer 2. But Layer 3+4 are the killers. NOTE: System Watcher and KSN details are theoretical based on Kaspersky documentation. Live trigger data pending.

$ # Signature evasion techniques: # - XOR obfuscation (key 0xB5 for dropper, 0xBE for shell) # - Polymorphism (mutate code structure each build) # - Ghost encoding (zero-width Unicode carrier) # - Phantom DLL hijack (load via legitimate process)

Ghost FUD.exe: 0/72 on VirusTotal Phantom DLL: loads via Office process Iron Sun beacon: XOR + AES + ghost wrap All bypass static signature scan — file appears as noise, not recognized code.

Static evasion is the entry fee. It gets you past the door, not past the guard.

$ # System Watcher rollback mechanism: # bRollbackAllowed=1 means KAV can undo changes # Triggers: file writes, registry changes, process injection # Monitors: Run keys, scheduled tasks, startup folders

System Watcher monitors: - Registry Run keys (HKCU/HKLM)\ - Scheduled tasks (schtasks) - Startup folders (AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup) - Service creation (sc.exe) - DLL injection (CreateRemoteThread) If ANY of these trigger after execution, KAV rolls back the changes within seconds.

Three-vector persistence (registry + task + LNK) is exactly what System Watcher watches.

$ # KSN (Kaspersky Security Network) flow: # 1. Unknown binary executes # 2. KSN sends file hash to cloud # 3. Cloud returns reputation score # 4. If score < threshold, file is flagged # 5. File may be sent for deeper analysis

KSN First-Run Penalty: New file + no reputation = suspicious Cloud analysis can take 30-60 seconds During analysis: file may be blocked After analysis: signature created, all future executions blocked The hash is the carrier file's hash — not the extracted payload. Ghost encoding doesn't help here. The file still has a face.

KSN is the reason 'it worked yesterday but not today' — reputation builds over time.

$ LAB EXERCISE: Evade Kaspersky on .92

1. Build a payload (calc.exe spawn or message box) 2. Test 1: Run bare payload — observe KAV detection 3. Test 2: XOR obfuscate with key 0xB5 — test again 4. Test 3: Add ghost encoding layer — test again 5. Test 4: Add Dark Room (HWBP on AMSI + ETW) — test again 6. Test 5: Implement persistence (registry Run key) - Observe if System Watcher rolls it back 7. Document which layer stopped you and why 8. BONUS: Build Iron Sun GCC variant and scan with avp.exe

.92 is a REAL target. Kaspersky is ACTIVE. If your payload survives, you earned it.

.92 Intel .42 AMD Real lab data • Tested live • VIDIMUS OMNIA