* Retrieve of DLL and PE from a remote server
* Manual Mapping on a remote process
* Position independent code
* Use of indirect Syscalls
- ZwAllocateVirtualMemory
- ZwProtectVirtualMemory
- ZwQuerySystemInformation
- ZwFreeVirtualMemory
- ZwCreateThreadEx
* Single stub for all Syscalls
- Dynamic SSN retrieve
- Dynamic Syscall address resolution
* Atlas also uses
- LdrLoadDll
- NtWriteVirtualMemory
* Custom implementations of
- GetProcAddress
- GetModuleHandle
* API hashing
* Cleanup on error
* Variable EntryPoint

‏1. Anti Debugging: ‏Disables specific anti-debugging mechanisms to facilitate debugging in certain scenarios.

‏2. BSoD (Blue Screen of Death): ‏Prevents or mitigates potential causes leading to system crashes or blue screen errors

‏3. BlockInput:‏Controls the system's input-blocking functionality to manage or bypass certain input restrictions.

‏4. FindWindow:‏Modifies the behavior of the FindWindow API function for specific use cases

Current Features
Process hiding and unhiding
Process elevation
Process protection (anti-kill and dumping)
Bypass pe-sieve
Thread hiding and unhiding
Thread protection (anti-kill)
File protection (anti-deletion and overwriting)
Registry keys and values protection (anti-deletion and overwriting)
Registry keys and values hiding
Querying currently protected processes, threads, files, hidden ports, registry keys and values
Function patching
Built-in AMSI bypass
Built-in ETW patch
Process signature (PP/PPL) modification
Can be reflectively loaded
Shellcode Injection
APC
NtCreateThreadEx
DLL Injection
APC
NtCreateThreadEx
Querying kernel callbacks
ObCallbacks
Process and thread creation routines
Image loading routines
Registry callbacks
Removing and restoring kernel callbacks
ETWTI tampering
Module hiding
Driver hiding and unhiding
Credential Dumping
Port hiding/unhiding
Script execution
Initial operations

Kill processes

ZwTerminateProcess is simply called from kernel land to terminate any process. Additionally, you can bury a process to avoid it to restart by setting a kernel callback to process creation: If the target process is created, Banshee will set the CreationStatus of the target process to STATUS_ACCESS_DENIED.

Change protection levels

This is done by modifying the EPROCESS structure, which is an kernel object that describes a processes attributes. It also holds a value that specifies the protection level of the process.
We can directly modify this value (aka Direct Kernel Object Modification or DKOM), since we are operating in Ring 0.

Elevate any process token to SYSTEM

EPROCESS also holds a pointer to the current access token, so we can just make it point to e.g. the token of process 4 (SYSTEM) to elevate any process to SYSTEM

Enumerating and erasing kernel callbacks

For now, only Process- and Thread-Creation kernel callbacks are enumerated, by parsing the PsSetCreateNotifyProcess/ThreadRoutine routine to reach the private Psp* routine and then parsing the address of the array, where kernel callbacks are stored.

Protecting the driver file

By hooking the NTFS filesystem's IRP_MJ_CREATE handler, we can block any process from opening a handle to our driver file

Hide Process by PID

Again, EPROCESS comes to help here - it contains a LIST_ENTRY of a doubly linked list called ActiveProcessLink which is queried by Windows to enumerate running processes. If we simply unlink an entry here, we can hide our process from tools like Process Monitor or Task Manager.