Zig Strike is a sophisticated offensive toolkit designed to bypass advanced security solutions, including Anti-Virus (AV), Next-Generation Antivirus (NGAV), and Endpoint Detection and Response (XDR/EDR) systems. KPMG said that the toolkit also incorporates local mapping techniques that leverage Windows file mapping APIs including CreateFileMappingW and MapViewOfFile to allocate executable memory, significantly reducing suspicious memory patterns typically flagged by EDR solutions. This open-source toolkit represents a significant evolution in red team capabilities, leveraging the modern Zig programming language to create highly evasive payloads that can circumvent even Microsoft Defender for Endpoint (MDE). These techniques ensure payloads execute only in legitimate corporate environments, bypassing automated security analysis systems. This development underscores the critical need for organizations to implement layered defense strategies and continuously update their security postures against evolving threats in the modern cybersecurity landscape. The Zig-based toolkit creates evasive payloads that bypass AV, XDR, and EDR security systems. Remote thread hijacking escalates this approach by targeting existing threads in remote processes, utilizing GetThreadContext and SetThreadContext APIs to manipulate the instruction pointer (RIP) directly to shellcode. Zig Strike fragments shellcode into smaller segments stored as Base64-encoded UTF16 wide-string variables within the PE file’s .rdata section, making detection significantly more challenging for static analysis engines. Employs four injection techniques, including thread hijacking and memory mapping for stealth execution. Future releases will incorporate direct and indirect syscalls, additional injection techniques, and sleep obfuscation methods to further enhance evasion capabilities. Remote mapping extends this concept through cross-process injection using MapViewOfFileNuma2 API to map shellcode into remote process address spaces.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 30 Jun 2025 07:35:13 +0000