Hiding inside the hunter.

A combination of DLL Sideloading, Module Overloading and a XOR-encrypted payload was enough to bypass CrowdStrike Falcon on a fully patched Windows 11 machine. The trick was in the sacrificial image.

01. Overview

CrowdStrike Falcon is one of the most widely deployed EDR solutions in enterprise environments. Evading it reliably is a real challenge — and most techniques that work against weaker products fail here. This post walks through a chain that worked, and explains why one small change made all the difference.

The execution chain breaks down into four steps: generate a shellcode with Adaptix C2, encrypt it with XOR and embed it inside a fake PDF file, use a legitimate signed binary vulnerable to DLL Sideloading, and have the sideloaded DLL perform Module Overloading to execute the shellcode in memory.

02. Payload generation and XOR encryption

Adaptix C2 is a post-exploitation and adversary emulation framework. Once the C2 server is running, it generates the raw shellcode that serves as the base for everything that follows.

The first step after generation is encryption. Without it, most EDRs catch the raw shellcode immediately — pattern matching on known signatures is fast and reliable. A simple XOR cipher is enough to break those signatures and avoid static detection.

The encrypted payload is then embedded inside a file that mimics a legitimate PDF document. This serves two purposes: it makes the file look benign to both automated analysis and to anyone who might inspect it manually.

03. DLL Sideloading and Module Overloading

DLL Sideloading exploits the way Windows resolves DLL paths. A legitimate, signed binary loads a DLL from its current directory. Because the binary itself is trusted and signed by a known vendor, the EDR is less suspicious of its behavior. We replace the expected DLL with our own malicious one.

Module Overloading is the technique the sideloaded DLL uses to execute the shellcode. Rather than allocating new executable memory — which EDRs monitor closely — it loads a legitimate executable image into memory and overwrites it with the payload. The module appears to be a known, trusted binary; the shellcode runs inside it.

The full chain: the signed binary is executed, it loads the malicious DLL from the same directory, the DLL reads the fake PDF and decrypts the XOR shellcode, the DLL performs Module Overloading using a sacrificial executable image, and the shellcode runs inside the overloaded module.

04. First test — notepad.exe as the sacrificial image

For the first attempt, notepad.exe is used as the sacrificial image for Module Overloading. CrowdStrike Falcon is fully running on the target machine:

CrowdStrike catches the payload instantly. The notification is unambiguous: a process was terminated because anomalous behavior was detected.

The EDR recognizes that something is wrong with the overloaded module. Using a standard Windows binary as the sacrificial image is not sufficient. CrowdStrike inspects what is running inside the module and flags the mismatch.

05. Second test — CSFalconContainer.exe as the sacrificial image

The question becomes: what happens if we use CrowdStrike's own binary as the sacrificial image? The LEGIT_IMG variable is changed to point to C:Program FilesCrowdStrikeCSFalconContainer.exe. Everything else stays identical — same payload, same DLL Sideloading chain, same XOR encrypted shellcode.

CrowdStrike trusts its own executables. By abusing that trust, we load our payload without triggering any alert.

The beacon appears on the Adaptix C2 panel. A live session is running on a Windows 11 x64 machine with CrowdStrike Falcon fully active. The process shows as PH1F.tmp crowdstrike — the EDR's own name, carrying our payload.

To confirm full access, a BOF (Beacon Object File) screenshot command is executed successfully. All CrowdStrike Falcon Sensor processes remain running in the background. The EDR is active, the beacon is alive, and commands execute without any detection.

06. Conclusion

One parameter. That is the entire difference between getting caught and getting in. Using notepad.exe as the sacrificial image, CrowdStrike detects and kills the process immediately. Using CSFalconContainer.exe, the same payload runs without any problem.

The lesson is not that CrowdStrike is broken — it is that any system which grants elevated trust to its own components can have that trust turned against it. The more an EDR trusts itself, the more valuable its own binaries become as cover.