Randomizing a string in an exploit is a common technique to evade signature-based detection, and often that string is just a group of random letters together. For example, if we do:
random.RandLettersRange(5, 10)
We'd get something like:
However, I find that sometimes randomness like that does not always help the situation, it might stand out more. For example, if I were to randomize a payload filename, to me this type of name would stand out already without me even inspecting the content of it:
But if I saw a name like this, I'd probably think it's ok because it looks more natural:
Another reason mixed letters randomness wouldn't work so well is because modern security tools have evolved to measure the randomness of strings with entropy analysis. For example, Yara has math.entropy(), Splunk has entropy(). CrowdStrike, Sentinel also have ML models to spot them. In those cases, a real natural word would be more evasive.
Randomizing a string in an exploit is a common technique to evade signature-based detection, and often that string is just a group of random letters together. For example, if we do:
We'd get something like:
However, I find that sometimes randomness like that does not always help the situation, it might stand out more. For example, if I were to randomize a payload filename, to me this type of name would stand out already without me even inspecting the content of it:
But if I saw a name like this, I'd probably think it's ok because it looks more natural:
Another reason mixed letters randomness wouldn't work so well is because modern security tools have evolved to measure the randomness of strings with entropy analysis. For example, Yara has
math.entropy(), Splunk hasentropy(). CrowdStrike, Sentinel also have ML models to spot them. In those cases, a real natural word would be more evasive.