Alice Climent

Malware and EDR stuff @harfanglab 🤓 || PTC || Sister of @h313n_0f_t0r & @lauriewired

[Alice Climent @AliceCliment]

Curious about what's happening in the Windows Kernel after a Syscall?

I just wrote this post following the worfkflow from the Syscall instruction to the target kernel routine ⬇️

https://t.co/PDc5eXZCyk

Thanks again to @Set_hyx for the proofreading!

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[Karsten Hahn @struppigel]

I have created a website, where you can share your sample analysis (via links or posts) and search samples for training based on tags and difficulty.

If you write analysis blogs, you can share them there.
https://t.co/9jlkRxfYW5

[Alice Climent @AliceCliment]

@Myrtus0x0 👀

[Amnesty Tech @AmnestyTech]

🚨 A new investigation jointly published by @insidestory_gr @haaretzcom & WAV Research Collective with the technical assistance of @Amnesty has exposed the internal operations of Intellexa, a company notorious for selling Predator spyware.

https://t.co/bjW0GClCSC

[Alice Climent @AliceCliment]

@vxunderground this tbh

[vx-underground @vxunderground]

You don't have to write super sophisticated malware with 9000 different evasion techniques

Just name it important_file.pdf.exe and have it prompt for UAC. They'll probably allow it

[Alice Climent @AliceCliment]

@gzobraJn 🫡

[Alice Climent @AliceCliment]

My blog is back online \o/

The new domain is https://t.co/DqSbvPWZ2I

[Alice Climent @AliceCliment]

@duckyctf Thna' you 🙏

[Alice Climent @AliceCliment]

@matteyeux

[Alice Climent @AliceCliment]

@artem_i_baranov Absolutely!

[Alice Climent @AliceCliment]

I just realized something. The advisory says:

"This issue does not add additional capabilities to an attacker with administrative privileges to damage the attacked system."

Well, that's not true. The PoC allows an attacker to remove EDR/AV files (exe, dll, drivers) and

[Alice Climent @AliceCliment]

The vulnerability I've found last year in @kaspersky AV is nows patched 🥳

https://t.co/gdez2diAOj

[Alice Climent @AliceCliment]

🤩🔥🔥🔥🤩

[Artem I. Baranov @artem_i_baranov]

Windows Rootkits and Bootkits Guide is available in an eye-friendly design and colors 🕶️🎆🎄 https://t.co/2rUVybPDQV

[Alice Climent @AliceCliment]

@YoursSto @BrHackeuses @kaspersky 🥹

[Alice Climent @AliceCliment]

@artem_i_baranov 4.4 according to them. They choose None for availability. For me it's High 🤷‍♀️

https://t.co/bOvVKFQPl7

[Alice Climent @AliceCliment]

@artem_i_baranov No... But I submited a CVE request to MITRE yesterday.

We'll see 🤷‍♀️

[Alice Climent @AliceCliment]

@artem_i_baranov Yes ! I just need to find the time to write it 😄

[Alice Climent @AliceCliment]

@artem_i_baranov yes and no. Usually vuln that need admin priv are not eligible for the bounty (which was ok with me because I wasn't asking/seeking any bounty. However after they analyze my report and PoC they decided to give me 1000€. Which was pretty cool of them !

[Alice Climent @AliceCliment]

a registry key, they are able to remove any AV/EDR on a Windows machine. BYOVD Style ( but without interacting directly with the driver though 😅).

If I found the time I'll write a blog post about this vuln

[Alice Climent @AliceCliment]

without any tools.

The PoC is using the driver indirectly (via specificaly crafted data in registry keys) to remove ANY files or registry keys after a reboot.

So yes, it adds new capabilities for the attackers to damage the system. Because with just the driver load and data in