Learning C/C++ and Assembly may be the best thing for Offensive Security

I read with interest how various Western Red Teams go through all lengths to get a single Mitre test working nicely, dumping lsass.exe.

In addition, the Blue Teams have a lot of help in this area with EDRs aka expensive Endpoint Detection and Response software hitting all alerts when you even try to get near to lsass.exe process.

Most of the red team companies do write great blogs documenting the efforts they put in their process dumpers.  Obviously they will not share their secret sauce in a free blog.

The logic is simple, why let their months of hard work go down the drain when some nice chaps will download their work to Virustotal or turn them into some machine learning generated signatures when the commercial EDR companies tow Virustotal for intelligence.

If you read their blogs carefully, how do they fool the EDRs using merely C/C++?  Yes, the mention syscall but they do not go reveal all their secrets easily.

Ok, luckily my C/C++ and x86 Assembly are largely intact despite some inactivity and I spent a few days developing software for a Mitre exercise to muck around the lsass.exe which can be extended to a larger red team exercise.

The hint is - "You do not just use C/C++, some knowledge of assembly language is required".  Not those shell code samples you read in many blogs.  

Well, the age of MASM is over, the trick is to make your malware modular modular.  Malware authors are not stupid, they do understand the basic software engineering skills and they have higher motivation than most tired and overworked Blue Team members.

Back to the topic, this is not a new idea, chaps in the 1980s-1990s era were using the same idea in memory trainers.  Well you can say that some legacy memory resident viruses were using the same idea too and somehow this idea came back to haunt modern EDRs.

In the modern era, people do Python and it is probably something better in there resume.  It is hard to find people who do C/C++ and Assembly and you probably feel out of place in the modern Cloud era but no worries, some old ideas if used properly are still valuable in a adversary simulation exercise.

A well run adversary simulation exercise is better than 5 compliance audits or 3 table top exercises.

And if you can write new or modify existing offensive tools in C/C++ or Assembly, you are on the road to interesting adversary simulation scenarios, if you have a chance to sell this idea to the management.