In accordance with the industry standard for vulnerability disclosures, NSS Labs is now publishing information previously withheld from the 2018 Next Generation Intrusion Prevention System Group Test reports.
| Test ID | NGIPS Resiliency Test Cases |
| res-wsp-001 | Both spaces and linefeeds replaced with multiples of each |
| res-wspch-001 | Both spaces and linefeeds replaced with multiples of each; chunked |
| res-wspcg-001 | Both spaces and linefeeds replaced with multiples of each; chunked and gzip compressed |
| res-ren-001 | Procedures and variables renamed |
| res-rench-001 | Procedures and variables renamed; chunked |
| res-rencg-001 | Procedures and variables renamed; chunked and gzip compressed |
| res-mth-001 | Numeric values/equations modified and/or inserted; hexadecimal values replaced with decimal values |
| res-mthch-001 | Numeric values/equations modified and/or inserted; hexadecimal values replaced with decimal values; chunked |
| res-mthcg-001 | Numeric values/equations modified and/or inserted; hexadecimal values replaced with decimal values; chunked and gzip compressed |
| res-chr-001 | Change all chr() to chrw() and vice versa where possible |
| res-chrch-001 | Change all chr() to chrw() and vice versa where possible; chunked |
| res-chrcg-001 | Change all chr() to chrw() and vice versa where possible; chunked and gzip compressed |
| res-chr-002 | Change chr() and chrw() to chrb() |
| res-chrch-002 | Change chr() and chrw() to chrb(); chunked |
| res-chrcg-002 | Change chr() and chrw() to chrb(); chunked and gzip compressed |
| res-chr-003 | Some script commands/strings converted to series of chr()/Clng/&H using online vbscript obfuscator |
| res-chrch-003 | Some script commands/strings converted to series of chr()/Clng/&H using online vbscript obfuscator; chunked |
| res-chrcg-003 | Some script commands/strings converted to series of chr()/Clng/&H using online vbscript obfuscator; chunked and gzip compressed |
| res-pay-001 | Nishang bind shell obfuscated with Unicorn |
| res-paych-001 | Nishang bind shell obfuscated with Unicorn; chunked |
| res-paycg-001 | Nishang bind shell obfuscated with Unicorn; chunked and gzip compressed |
| res-pay-002 | Native Unicorn generated bind shell |
| res-paych-002 | Native Unicorn generated bind shell; chunked |
| res-paycg-002 | Native Unicorn generated bind shell; chunked and gzip compressed |
| res-pay-003 | Nishang bind shell obfuscated with PowerSploit’s Out-EncodedCommand |
| res-paych-003 | Nishang bind shell obfuscated with PowerSploit’s Out-EncodedCommand; chunked |
| res-paycg-003 | Nishang bind shell obfuscated with PowerSploit’s Out-EncodedCommand; chunked and gzip compressed |
| res-pay-004 | Veil Ordnance bind shell shellcode dropped into PowerSploit’s Invoke-Shellcode; then obfuscated with PowerSploit’s Out-EncodedCommand |
| res-paych-004 | Veil Ordnance bind shell shellcode dropped into PowerSploit’s Invoke-Shellcode; then obfuscated with PowerSploit’s Out-EncodedCommand; chunked |
| res-paycg-004 |
Veil Ordnance bind shell shellcode dropped into PowerSploit’s Invoke-Shellcode; then obfuscated with PowerSploit’s Out-EncodedCommand; chunked and gzip compressed |
| res-pay-005 | Use wscript to call original payload (PoshRat method) |
| res-paych-005 | Use wscript to call original payload (PoshRat method); chunked |
| res-paycg-005 | Use wscript to call original payload (PoshRat method); chunked and gzip compressed |
| res-ord-001 | Remove runmumaa and add to setnotsafemode function; move setnotsafemode function to bottom of script |
| res-ordch-001 | Remove runmumaa and add to setnotsafemode function; move setnotsafemode function to bottom of script; chunked |
| res-ordcg-001 | Remove runmumaa and add to setnotsafemode function; move setnotsafemode function to bottom of script; chunked and gzip compressed |
| res-spl-001 | Some strings split with “+” and “&”; some lines split with “_” |
| res-splch-001 | Some strings split with “+” and “&”; some lines split with “_”; chunked |
| res-splcg-001 | Some strings split with “+” and “&”; some lines split with “_”; chunked and gzip compressed |
| res-mrg-001 | Combine ‘myarray’ instantiation into single line; combine powershell command into single line |
| res-mrgch-001 | Combine ‘myarray’ instantiation into single line; combine powershell command into single line; chunked |
| res-mrgcg-001 | Combine ‘myarray’ instantiation into single line; combine powershell command into single line; chunked and gzip compressed |
| res-renchr-001 | Combination of techniques used in res-ren-001 and res-chr-003 |
| res-renchrch-001 | Combination of techniques used in res-ren-001 and res-chr-003; chunked |
| res-renchrcg-001 | Combination of techniques used in res-ren-001 and res-chr-003; chunked and gzip compressed |
| res-renchrwsp-001 | Combination of techniques used in res-ren-001; res-chr-003; and res-wsp-001 |
| res-renchrwspch-001 | Combination of techniques used in res-ren-001; res-chr-003; and res-wsp-001; chunked |
| res-renchrwspcg-001 | Combination of techniques used in res-ren-001; res-chr-003; and res-wsp-001; chunked and gzip compressed |
| res-renchrwsppay-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; and res-pay-004 |
| res-renchrwsppaych-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; and res-pay-004; chunked |
| res-renchrwsppaycg-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; and res-pay-004; chunked and gzip compressed |
| res-renpay-001 | Combination of techniques used in res-ren-001 and res-pay-004 |
| res-renpaych-001 | Combination of techniques used in res-ren-001 and res-pay-004; chunked |
| res-renpaycg-001 | Combination of techniques used in res-ren-001 and res-pay-004; chunked and gzip compressed |
| res-renchrwsppaymth-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; res-pay-004; and res-mth-001 |
| res-renchrwsppaymthch-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; res-pay-004; and res-mth-001; chunked |
| res-renchrwsppaymthcg-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; res-pay-004; and res-mth-001; chunked and gzip compressed |
| res-renchrwsppaymthspl-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; res-pay-004; res-mth-001; res-spl-001 |
| res-renchrwsppaymthsplch-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; res-pay-004; res-mth-001; res-spl-001; chunked |
| res-renchrwsppaymthsplcg-001 | Combination of techniques used in res-ren-001; res-chr-003; res-wsp-001; res-pay-004; res-mth-001; res-spl-001; chunked and gzip compressed |
| res-mthmrg-001 | Combination of techniques used in res-mth-001 and res-mrg-001 |
| res-mthmrgch-001 | Combination of techniques used in res-mth-001 and res-mrg-001; chunked |
| res-mthmrgcg-001 | Combination of techniques used in res-mth-001 and res-mrg-001; chunked and gzip compressed |
| res-mthmrgord-001 | Combination of techniques used in res-mth-001; res-mrg-001; and res-ord-001 |
| res-mthmrgordch-001 | Combination of techniques used in res-mth-001; res-mrg-001; and res-ord-001; chunked |
| res-mthmrgordcg-001 | Combination of techniques used in res-mth-001; res-mrg-001; and res-ord-001; chunked and gzip compressed |
| res-mthmrgordpay-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; and res-pay-005 |
| res-mthmrgordpaych-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; and res-pay-005; chunked |
| res-mthmrgordpaycg-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; and res-pay-005; chunked and gzip compressed |
| res-mthmrgordpayspl-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; and res-spl-001 |
| res-mthmrgordpaysplch-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; and res-spl-001; chunked |
| res-mthmrgordpaysplcg-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; and res-spl-001; chunked and gzip compressed |
| res-mthmrgordpaysplchr-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; and res-chr-003 |
| res-mthmrgordpaysplchrch-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; and res-chr-003; chunked |
| res-mthmrgordpaysplchrcg-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; and res-chr-003; chunked and gzip compressed |
| res-mthmrgordpaysplchr-002 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; and res-chr-003; plus removal of all CLng’s |
| res-mthmrgordpaysplchrch-002 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; and res-chr-003; plus removal of all CLng’s; chunked |
| res-mthmrgordpaysplchrcg-002 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; and res-chr-003; plus removal of all CLng’s; chunked and gzip compressed |
| res-mthmrgordpaychr-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; and res-chr-003 |
| res-mthmrgordpaychrch-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; and res-chr-003; chunked |
| res-mthmrgordpaychrcg-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; and res-chr-003; chunked and gzip compressed |
| res-mthmrgordpaysplchrwsp-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; res-chr-003; res-wsp-001; plus removal of all CLng’s |
| res-mthmrgordpaysplchrwspch-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; res-chr-003; res-wsp-001; plus removal of all CLng’s; chunked |
| res-mthmrgordpaysplchrwspcg-001 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-005; res-spl-001; res-chr-003; res-wsp-001; plus removal of all CLng’s; chunked and gzip compressed |
| res-mthmrgordpaysplchrwsp-002 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-001; res-spl-001; res-chr-003; res-wsp-001; res-ren-001; plus removal of all CLng’s; replace ‘LANGUAGE=”VBScript”‘ with ‘type=”text/vbScript”‘ |
| res-mthmrgordpaysplchrwspch-002 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-001; res-spl-001; res-chr-003; res-wsp-001; res-ren-001; plus removal of all CLng’s; replace ‘LANGUAGE=”VBScript”‘ with ‘type=”text/vbScript”‘; chunked |
| res-mthmrgordpaysplchrwspcg-002 | Combination of techniques used in res-mth-001; res-mrg-001; res-ord-001; res-pay-001; res-spl-001; res-chr-003; res-wsp-001; res-ren-001; plus removal of all CLng’s; replace ‘LANGUAGE=”VBScript”‘ with ‘type=”text/vbScript”‘; chunked and gzip compressed |