APT Attack Methodology

01 · INITIAL ACCESS + EXECUTION
Spearphishing → Masqueraded EXE
T1566.002 T1204.002
  • Phishing email with payload hosted on legitimate cloud storage (e.g. Tencent, OneDrive) — URL reputation checks bypassed
  • ZIP contains a real decoy document + EXE disguised with a document icon; Windows hides .exe extension by default
  • Victim sees two PDF files, double-clicks the fake — downloader runs silently with no visible window
  • No malicious infrastructure in email headers; sender domain is clean
Lure.zip Invoice_Detail.pdf <- real decoy, opens normally Invoice_2026.pdf <- actually Invoice_2026.pdf.exe // Windows hides extension -> victim sees two identical PDF icons
02 · STAGING + DLL SIDELOADING
Signed Binary + Malicious DLL → Same Folder
T1105 T1574.002
  • Downloader fetches a legitimate signed binary + malicious DLL from attacker-controlled cloud bucket into the same folder
  • DLL contains embedded .sys kernel drivers and shellcode packed in its Resources section
  • Windows DLL search order: app directory is checked BEFORE System32 — attacker DLL wins automatically
  • Signed binary launches → loads malicious DLL from same dir; EDR sees a trusted process loading its own DLL
C:\Users\victim\AppData\Roaming\[folder]\ LegitApp.exe <- Microsoft-trusted signature, clean TargetDLL.dll <- malicious; embeds .sys drivers + shellcode // DllMain() executes -> attack begins inside trusted process
03 · BYOVD RING 0
3-Driver Kernel Attack — EDR Killed from Ring 0
T1562.001 KERNEL
  • DLL extracts 3 vulnerable .sys drivers from its embedded Resources — written to disk then loaded via SCM (CreateService + StartService)
  • Opens device handle to driver, sends IOCTL with EDR process PID — driver calls ZwTerminateProcess(EDR) from Ring 0
  • 3 drivers = modular fallback: if one is on the Microsoft blocklist, the next is tried automatically
  • PPL-protected AV processes (MsMpEng, SentinelOne) cannot resist a Ring 0 terminate — protection model bypassed
CreateService(SCM, "drv", ..., SERVICE_KERNEL_DRIVER, ...) StartService(hSvc, ...) // driver loaded into kernel hDev = CreateFile("\\\\.\\VulnDriver", ...) DeviceIoControl(hDev, IOCTL_KILL, &edr_pid, 4, ...) // ZwTerminateProcess(EDR_PID) from Ring 0 -> unstoppable
↓
04 · DEFENSE EVASION
NTDLL Unhooking — EDR Blind at User-Mode Level
T1562.001
  • EDR installs JMP hooks at the start of every NTDLL syscall stub to intercept and inspect API calls
  • Attacker reads a clean, unhooked copy of ntdll.dll directly from disk (not from memory)
  • Overwrites the hooked bytes in the live process memory — all JMP detours removed, original stubs restored
  • Combined with BYOVD: EDR process is dead at kernel level AND blind at user-mode level simultaneously
// Before: EDR intercepts every syscall NtCreateProcess: JMP 0x7FFE1234 -> EDR_Inspector -> EDR logs // After: original bytes restored from disk NtCreateProcess: MOV R10, RCX MOV EAX, 0x4C // syscall number SYSCALL // goes straight to kernel
05 · C2 + PROCESS INJECTION
Thread-Context Hijack → Shellcode in Trusted Process
T1055.003
  • Shellcode fetched from C2 server at runtime — never written to disk (fileless)
  • Targets an existing svchost.exe instance (trusted Windows process); no new process spawned
  • Allocates RWX memory in target via VirtualAllocEx, writes shellcode via WriteProcessMemory
  • Finds an existing thread, suspends it, redirects its RIP register to shellcode, resumes — no new thread created
OpenProcess(PROCESS_ALL_ACCESS, svchost_pid) VirtualAllocEx(hProc, PAGE_EXECUTE_READWRITE) WriteProcessMemory(hProc, pRemote, shellcode, size) SuspendThread(hThread) ctx.Rip = (DWORD64)pRemote // redirect to shellcode SetThreadContext + ResumeThread // executing
06 · PERSISTENCE + REMOTE ACCESS
Dual Watchdog + Full C2 Control
T1053.005 RAT
  • Watchdog 1 (internal DLL thread): monitors shellcode memory address every ~500ms — if evicted, re-fetches from C2 and re-injects
  • Watchdog 2 (external batch script): checks loader process every ~10s — if killed, relaunches immediately
  • Scheduled Task monitors batch script itself — fires on every boot, recreates script if deleted
  • RAT capabilities: full remote shell, file upload/exfil, recon (whoami/ipconfig/tasklist), modular payload loading on demand
location: shellcode running inside svchost.exe on-disk: loader EXE + DLL only (no RAT binary) recovery: internal watchdog + external watchdog + sched task C2 comms: encrypted, blends with svchost network traffic