Create an in-memory patching type
Tactic: Defense-evasion
Creates a "JambiPatcher" type that imports kernel32.dll and exports GetProcAddress, LoadLibrary, VirtualProtect, and a
custom "copy" function with the follow prototype:
public static void Copy (byte[] source, int startIndex, IntPtr destination, int length) {
Marshal.Copy(source, startIndex, destination, length);
}
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsUse Powershell functions to create a script implant that dynamically resolves and loads modules at runtime.
Jambi Modules
2021-11-16
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github