Failed to detect injection(OpenThread-> QueueUserAPC-> ResumeThread) by MSBuildAPICaller about pe-sieve HOT 5 CLOSED

Thank you for reporting, I will check it!

from pe-sieve.

What was the shellcode injected? PE-sieve detects the payload, not the method of injection (it does a passive scan and no API hooking). If the shellcode was small and obfuscated, it would possibly not detect it.

from pe-sieve.

Shellcode was simple meterpreter reverse_tcp shell.

PE-sieve detects the payload, not the method of injection (it does a passive scan and no API hooking). If the shellcode was small and obfuscated, it would possibly not detect it.

Thanks, it makes sense.

from pe-sieve.

@duzvik - please check if the recent commit solved the problem. You can get the latest builds from the build server: 64bit and 32bit

from pe-sieve.

I think it should work fine in the latest release, but please check and let me know: https://github.com/hasherezade/pe-sieve/releases

from pe-sieve.