diff --git a/README.md b/README.md
@@ -303,22 +303,12 @@ shutdown /r /t 0
- Adds persistence: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
- Policy applies system-wide at next boot during kernel initialization
-**Benefits:**
-
-- **Complete EDR failure**: User-mode components cannot initialize
-- **System-level enforcement**: Applied before EDR agents start
-- **Cannot be bypassed at runtime**: Kernel Phase 0 enforcement
-- **No detection**: Legitimate Windows security feature
-- **Persistent**: Remains active until policy is disabled and system is restarted
-
**Detection Difficulty:**
-- Very High: Uses legitimate Windows security policy
- EDR logs will show DLL load failures (after it's too late)
- No suspicious process behavior
-- Registry modification is standard Windows administration
-** [!] Warning:**
+**Warning:**
This technique:
- Requires Administrator privileges (no automatic UAC)
@@ -327,8 +317,6 @@ This technique:
- Blocks ALL non-Microsoft DLLs system-wide (may break some applications)
- Operator must manually remove policy after testing
-Use only in authorized red team engagements and penetration testing.
-
---
### LNK Format: Windows Shortcut Delivery
@@ -375,9 +363,7 @@ myph_v2 -s payload.bin -f setup.lnk -b lnk -e aes256 -t create-fiber
**Detection Difficulty:**
-- Medium: PowerShell execution is commonly monitored
- AV/EDR may flag suspicious PowerShell behavior
-- Can be improved with obfuscation and anti-detection techniques
- Consider using `--with-string-encryption` for better evasion
---
diff --git a/src/main.rs b/src/main.rs
@@ -48,7 +48,7 @@ const ASCII_ART: &str = r#"
,:::::' ; OOO (1974 - 2016)
::::::; ; OOOOO
;:::::; ; OOOOOOOO
- ,;::::::; ;' / OOOOOOO v2.1.0
+ ,;::::::; ;' / OOOOOOO v2.1.2
;::::::::: . ,,,;. / / DOOOOOO
.';:::::::::::::::::;, / / DOOOO
,::::::;::::::;;;;::::;, / / DOOO AV / EDR evasion framework
| |