This method uses its own encryption to avoid EDR alerts. It looks like the process can be defeated if the disk is encrypted; without the benefit of the operating system to decrypt the files, it reads the location of the master file table and iterates through looking for specific file signatures. If the disk is encrypted at the file table level or the file level, reading the raw information from the disk will prevent it from correctly identifying the signatures or getting anything useful from the files.
this post was submitted on 15 Sep 2025
5 points (100.0% liked)
blueteamsec
496 readers
27 users here now
For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.
founded 2 years ago
MODERATORS