Challenge 01: Binary Rename

Easy Process Name Evasion Target: Rule 1

Objective

Execute mimikatz.exe without the EDR detecting it via the process name blacklist.

Scanner Behavior

Rule 1 checks new processes against a hardcoded list of known tool names:

const BlacklistedProcesses = [
  "mimikatz.exe", "procdump.exe", "procdump64.exe",
  "dumpert.exe", "nanodump.exe", "rubeus.exe", ...
]

proc ruleProcessBlacklist(info: ProcessInfo): seq[Detection] =
  for name in BlacklistedNames:
    if info.exeName == name:  # exact match
      ...

The check uses exact string comparison against the process executable name.

Rules

You must execute the actual mimikatz binary (or a test binary named mimikatz.exe)
The EDR must not trigger a BLACKLISTED_PROCESS detection
You may modify the filename but not the file content

Hints

Hint 1

The blacklist checks the exact filename. What happens if the filename changes?

Hint 2

Windows doesn't care what you name an executable. Try renaming it.

Hint 3

copy mimikatz.exe m.exe - does the EDR still detect m.exe?