redNULL

Red. Hacking the planet. My other computer is your domain controller.

[FAMASoon @FAMASoon]

raskolnikov90/Beatrice.py: Modify machine code in binaries with alternative x64 assembly opcodes for AV evasion - https://t.co/LYfquDQ3y8

[Two Seven One Three @TwoSevenOneT]

New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker

[Fabian Bader @fabian_bader]

In my latest blog "Now You See Me: AADGraphActivityLogs" I explore the newly released Azure AD Graph logs and demonstrate how you can detect tools like ROADtools and AADinternals that rely on this API and have been under the radar for defender so far.

https://t.co/TXlkbsqKHa

[SEKTOR7 Institute @SEKTOR7net]

Bring Your Own Trusted Binary (BYOTB).

Tools, tunnels and trusts, a post by David Kennedy (@JUMPSEC)

Source: https://t.co/DsCEO7HQbW

#redteam #blueteam #maldev #malwaredevelopment

[Swissky @pentest_swissky]

The Practitioner’s Guide to AI-Enhanced Hacking
Learn how AI can elevate your hacking workflows. - Andrew Pratt - @CaidoIO
https://t.co/osnffBCoLF

[Swissky @pentest_swissky]

Nightmare On NTLM Street: Legacy's Revenge - Marina Bochenkova
https://t.co/BGZthSCrnS

[DirectoryRanger @DirectoryRanger]

How You Can Impersonate Anyone in Active Directory (with Shikata!)
https://t.co/ecPqv56O2W

[Florian Hansemann @CyberWarship]

''GitHub - p0dalirius/ShareHound: A python tool to map the access rights of network shares into a BloodHound OpenGraphs easily''

#infosec #pentest #redteam #blueteam
https://t.co/WRf4ZRrYpp

[SEKTOR7 Institute @SEKTOR7net]

DarkGate - a modular persistent malware with evasion and creds collection capabilities.

A post by Sapir Twig.

Source: https://t.co/L3wo9wJLoX

#redteam #blueteam #maldev #malwaredevelopment

[Swissky @pentest_swissky]

This cheatsheet maps common impacket workflows to their modern alternatives - @n00py1
https://t.co/KQJkQvF4ow

[Clandestine @akaclandestine]

TrustedSec | Abusing Chrome Remote Desktop on Red Team Operations: A… https://t.co/i2kREFMMzH

[SEKTOR7 Institute @SEKTOR7net]

Building a kernel driver to play with AV.

A post by Sender (@cerbersec ) and Jonas Bauters.

Source: https://t.co/HxdJzEWNbo

#redteam #blueteam #maldev #malwaredevelopment

[Nicolas Krassas @Dinosn]

Another BYOVD process killer. works on all EDR's. fully signed. https://t.co/LGrjf7TnE7

[DirectoryRanger @DirectoryRanger]

Red Team Gold: Extracting Credentials from MDT Shares, by @Oddvarmoe
https://t.co/I3OqoU4NF6

[SEKTOR7 Institute @SEKTOR7net]

Coercing Windows - a collection of relay attacks with valid AD account.

A post by @RedTeamPT

Source: https://t.co/x0bUdgcNzY

#redteam #blueteam #maldev #malwaredevelopment

[DirectoryRanger @DirectoryRanger]

BitlockMove. Lateral Movement via Bitlocker DCOM & COM Hijacking, by @ShitSecure
https://t.co/e8hoFAqNQw

[Co11ateral @co11ateral]

MorphKatz

MorphKatz rewrites x86-64 machine code inside PE executables and raw shellcode into semantically identical but byte-different equivalents

https://t.co/DQxO5KtPL6

#forensics #evasion #pentesting

[SEKTOR7 Institute @SEKTOR7net]

NativeDump

Minidumps using native API only to dump LSASS memory, a tool by Ricardo Ruiz (@RicardoJoseRF )

Source: https://t.co/9jXEHLNkQN

#redteam #blueteam #maldev #malwaredevelopment

[DirectoryRanger @DirectoryRanger]

ShareHound: Mapping rights of network shares using bloodhound OpenGraph, by @podalirius_
https://t.co/7wIce883Mv

[Panos Gkatziroulis 🦄 @ipurple]

Internal NTDLL Functions for Shellcode Execution https://t.co/s7L4SeAmZa