Reformatted Structure
Polymorphic Code Integration
SysWhispers 3 Integration
AES Encryption
Early Bird Injection
Module Stomping

Detection approach

There is no native way to list and interact with WFP. To do that we need to use the NtObjectManager module.

With the help of NtObjectManager we will be able to list all filters and the approach will be:

Create a list with the executables you want to check
Listed filters that block connections
Filter that list by the executables provided

3DES Encryption
Sandbox Evasion
Analysis Evasion
Execution delay
Process Hollowing
Sign to cs and msf

Windows Defender
Malwarebytes Anti-Malware
CrowdStrike Falcon EDR (Falcon Complete + OverWatch)

Manually implementing NTAPI operations through indirect system calls
Disabling Breaking telemetry features (i.e ETW)
Polymorphism through compile-time hash generation
Obfuscating API function names and pointers
Duplicating existing LSASS handles instead of opening new ones
Creating offline copies of the LSASS process to perform memory dumps on
Corrupting the MDMP signature of dropped files
Probably other stuff I forgot to mention here