Patryk Czeczko

Red/purple teamer

[Patryk Czeczko @0xPat]

I'm giving 2 talks at @layer_one together with @c0p0x this weekend:
https://t.co/5rfp2zaURe
#purpleteam #malware

[Patryk Czeczko @0xPat]

https://t.co/38Gq8VSjDi
This year during @x33fcon we will code some covert shellcode loader in C++
@c0p0x #redteam #purpleteam #malware #workshop

[/ˈziːf-kɒn/ @x33fcon]

Would you like to learn more about Applied #PurpleTeaming? Come and join us, @0xPat and @c0p0x tomorrow at 1500 UTC.

Learn more: https://t.co/uRRV5npa5B

Free registration: https://t.co/dcz3MERHx6

[Patryk Czeczko @0xPat]

Co-trainer @c0p0x

[Patryk Czeczko @0xPat]

https://t.co/U8euAL0i4Q
Check out my Applied Purple Teaming training on @x33fcon

[Patryk Czeczko @0xPat]

https://t.co/TIODcIc18v
Implementing COFF loader/injector (aka beacon object file)

[Patryk Czeczko @0xPat]

https://t.co/vglZjuLE6p
Some advanced obfuscation techniques for C code

[Patryk Czeczko @0xPat]

https://t.co/Y6qIWpAIEZ
Check out compilation tips, PE overwiew, hiding imports, API hashing and calculating entropy

[Grzegorz Tworek @0gtweet]

Eliminate huge part of lateral movement scenarios with one command: "reg.exe add HKLM\SYSTEM\CurrentControlSet\Control /v DisableRemoteScmEndpoints /t REG_DWORD /d 1"
It will make Service Control Manager deaf to remote management. Everything else works properly.

[Andy Robbins @_wald0]

Did you know that LinkedIn has a directory?

https://t.co/Jjx1puLWrh

[Patryk Czeczko @0xPat]

https://t.co/xbm2U8yGgR
detecting debuggers and other tricks to make dynamic analysis of malware harder

[Patryk Czeczko @0xPat]

@zz0eyu I think the memory pages are not shared by default, unless there's some interaction going on from other process, like debugger for example.

[Patryk Czeczko @0xPat]

https://t.co/DmM2tsN3oc
On detecting VMs, evading sandboxes, bypassing function hooks

[Vlado Vajdic @vvlado]

Detecting APT29: MITRE EDR evaluations round 2 - Jorrit Folmer - Medium -> not everyone is a winner! https://t.co/YImm1TStxk

[Adam Chester 🏴‍☠️ @_xpn_]

Well this is awkward 😂 Nice logo tho.

[Marc Smeets @MarcOverIP]

In case you missed it: Im writing a multi part blog on RedELK, @OutflankNL’s open sourced tooling that acts as a red team SIEM and helps with overall improved oversight during red team operations:

https://t.co/jpfWDEFOI4

https://t.co/BCrcm5Uieo

https://t.co/NTyF6bVnOX

[Grzegorz Tworek @0gtweet]

Wanted to demonstrate AdjustTokenPrivileges() -> SomePrivilegedCall() sequence, and failed with SetSystemTime(). And now I know: SetSystemTime() tries to adjusts privileges on it's own, not even checking the result, and then calls NtSetSystemTime() syscall. Interesting...

[Patryk Czeczko @0xPat]

https://t.co/eLgE6NRtiY
on developing shellcode loader