In this course, Resource Development with ColdFire, you’ll cover how to utilize ColdFire to execute a full-chain infection from a loader to a stage 2 implant in a red team environment. First, you’ll demonstrate how ColdFire can be used to detect being in a sandbox or virtualized environment. Next, you’ll perform some execution guardrails with ColdFire to enumerate the system and validate it’s the intended target machine. Finally, you will cover loading some shellcode in memory with one of ColdFire’s helper functions. When you’re finished with this course, you’ll have the skills and knowledge to execute these techniques: sandbox evasion (T1497), process injection (T1055), execution guardrails (T1480) using ColdFire. More importantly, knowing how these techniques can be used against you will ultimately lend to your ability as an organization, or an individual, to detect and defend against specific attack vectors.
Author Name: Aaron Diaz
Author Description:
Aaron Diaz has worked primarily as a government contractor working with different branches of the military and government agencies. Aaron has worked as a Threat Hunter, Malware Reverse Engineer, Software Developer, and a Penetration tester. He is passionate about reverse engineering software and all things related to offensive security (malware/exploit development). During his tenure on a Threat Hunting team, he became the lead Malware Reverse Engineer. This sparked a love for understanding how … more