Pikered

ZAIUX® Evo: Internal Penetration Test (BAS)

ZAIUX® Evo is a Full Cloud solution designed for MSSPs that automates Command and Control (C2) attack activities, generating reports free of false positives and complete with a Remediation Plan.

Discover our strengths:

• Realistic — Simulate a hacker attack in MS Active Directory environments under real conditions, without the need to create exclusion rules in the firewall or other defense systems, generating undetectable traffic levels in the network.
• Full Cloud — Thanks to the use of the centralized Cloud platform, each BAS always uses the latest updates. The simulation also takes place externally, like a real attack.
• Agentless — It works like real malware and leaves no trace at the end of the BAS*. No network probe installation or endpoint agent is required.
• Simple — Simply configure a simulation from the Dashboard and launch the First Stage package on the target network.
• AI-Driven — Thanks to the DPZR™ AI engine, ZAIUX® Evo's virtual Red Team can orchestrate and execute multiple attack techniques simultaneously, adopting a realistic and optimized approach.
• Clear Reporting — The customizable report shows completed attacks and their impact on network assets.
• Integrable — Thanks to APIs, ZAIUX® Evo can be integrated with other software solutions.

How does our BAS software work?

ZAIUX® Evo makes it possible, for the first time, to run a complete and realistic intrusion simulation in an MS Active Directory environment with an intelligent solution, leveraging a regularly updated range of the most advanced and current hacking techniques, executed in stealth mode to emulate a human approach. Automation is driven by the DPZR™ engine, which includes Machine Learning algorithms purpose-built by our expert team to emulate human intelligence while removing the time barrier of manual execution.

With the help of Artificial Intelligence, our adaptive algorithms shape the system's response based on the attack surfaces detected in the scans, all in a fully automated manner.

ZAIUX® Evo performs the most sophisticated attack techniques, including:

• EDR/XDR Evasion out-of-the-box
• C2 communication via HTTPS + SMB Pivoting
• AD Health check
• Ransomware Simulation
• Lateral Movement
• Privilege Escalation
• In-Process .NET Assembly execution
• Active Directory misconfiguration leveraging

ZAIUX® Framework Command-and-Control

An advanced software solution for Command-and-Control activities dedicated to authorized Red Teaming operations.

Features:

• LoadLibrary Proxy — LoadLibrary is delivered via Windows API and legitimate memory regions, keeping the Stack clean whenever a library is loaded into memory.
• Thread Stack Spoofing and Return Address Spoofing — Perform thread stack spoofing before Sleep without calling Sleep or NtDelayExecution.
• Automatically free the Shellcode’s memory region — Do not delegate to the operator the task of freeing the initially allocated memory region for the Shellcode.
• Choose between two different Sleep Obfuscation techniques — Prevent Memory Scanners from identifying the Payload during Sleep cycles.
• Patchless AMSI & ETW Evasion — The AMSI and ETW Bypass is handled using stealth techniques, avoiding any Byte-Patching in ntdll.dll or amsi.dll.
• Automatically unhook User-Land Callbacks — Prevent EDRs from tracking Syscalls and Libraries by disabling their monitoring routines.
• Inline .NET, EXE, and Coff Execution — Run .NET, COFF, and EXE in the current process memory, bypassing control by avoiding “Fork n’ run” operations.
• HTTPS, SMB, and DNS over HTTPS Communication — In addition to the default HTTPS protocol, the implant can use SMB and DNS over HTTPS for stealth communication.
• Indirect Syscalls + Dynamic SSN Resolution on-the-fly — Change the Return Address of Syscalls in ntdll.dll memory and automatically resolve System Service Numbers.