Ivy is a framework that enables the execution of arbitrary VBA code directly in memory. It achieves this by leveraging programmatic access within the VBA environment to load, decrypt, and execute shellcode. By operating entirely in memory, Ivy significantly reduces the likelihood of detection by Endpoint Detection and Response (EDR) systems that often rely on file-based analysis.
Ivy's unique approach to in-memory execution and EDR unhooking makes it a distinctive payload creation framework. Its use of RC4 encryption and techniques to bypass memory protection mechanisms allows for difficult detection. The functionality to unhook common system DLLs and patch ETW syscalls provides advanced evasion capabilities.
- In-Memory Execution: Executes VBA code entirely in memory to evade file-based detection.
- EDR Unhooking: Hooks and unhooks common system DLLs (e.g., Ntdll.dll, Kernel32.dll) to bypass EDR monitoring.
- ETW Patching: Patches ETW (Event Tracing for Windows) syscalls to prevent telemetry generation.
- RC4 Encryption: Uses RC4 encryption to obfuscate loader components and prevent decoding analysis.
- Flexible Payload Delivery: Supports both 64-bit and 32-bit payloads with options for process injection or direct loading.
- Configuration Options: Provides command-line parameters to control payload type, output file, debugging, and other aspects.
- Go Implementation: Developed in Go, offering portability and performance.
Ivy is an archived project that has demonstrated viable fileless execution techniques. Its creation of custom WriteProcessMemory functions and EDR unhooking capabilities indicate a sophisticated understanding of system internals. The project has a limited community presence and is no longer actively maintained as of the last commit date.
Ivy is valuable for security researchers and penetration testers seeking to understand and develop advanced fileless attack techniques. It offers a framework for creating stealthy VBA payloads that can bypass traditional security defenses. Understanding Ivy is crucial for developing countermeasures against this type of attack.