Funny how Microsoft attempts to fix Defender resulted in a bug that causes Defender to be unable to delete any malware with NTFS ADS file name, something like C:\test:mlwr.exe will never be deleted by Defender, will be detected but always fails to delete.
If you enjoyed my killing AD attack paths ContinuumCon talk, then I think you will like this too.
In this podcast, my teammate Tyler and I talk about how you can use ADeleg to find attack paths in Active Directory.
This is like literally the process I use on internals.
🎧https://t.co/7N1ogeMM5D
Last week, I wrote about WinGet and how it could be used for code execution, including detailed detection strategies. If you missed the article, have a read below ⤵️
🖊️ https://t.co/yI5f2t1mtE
😱 TIL of Railgun..so cool how you can use Win API of the target directly through a meterpreter session.
If you want to get to know more check out @mubix explain about using it
https://t.co/b38Wgnk1db
MSF's Railgun was massively underrated but incredibly powerful. Resolve and call an API without needing to alloc and run a whole BOF or DLL. I hope to get this implemented nicely in CrystalC2 at some point.
Kubernetes assessments just got easier.
@RonJonArod dropped two new Mythic extensions for helping with initial access on container-centric red team ops:
➡️ Wrap payloads in OCI images
➡️ Host them in a self-managed registry
➡️ Deploy via K8s manifest
https://t.co/iRXh7VS3gD
New video: quick run through of 5 post-access Microsoft 365 abuse mechanisms (app creds, Graph permanent delete, Intune device wipes/scripts, MDE LR)
WATCH: https://t.co/NsuVbUBBgC
Lot of defensive controls I didn’t fit in e.g. workload identities or most RBAC things... more on those soon.
Tool to dump Windows Local SAM Credentials from registry or Shadow Snapshot and capable of doing Stack Spoofing via TP Custom Callbacks.
When using Shadow Snapshot method SYSTEM privs are not needed.
https://t.co/8O4LOyA1Mh
#redteam#cybersecurity#windows
When WDAC blocks your implants, Electron apps become the way in.
The post walks through using Loki C2 to backdoor signed applications like Mailspring and communicate over Azure Blob Storage via HTTPS. ⬇️
https://t.co/7dWMTHrN8w
DLL Injection via Thread Hijacking Without Executable Memory
New Medium post. Today we cover a technique that combines thread hijacking with Return-Oriented Programming (ROP) to inject a DLL into a remote process without allocating executable memory
https://t.co/agjGzWx69v
We are releasing Tracebit @x33fcon - a POC sensor aiming to fingerprint implants in memory
using only lowlevel runtime telemetry.
No signatures, no scanning. Only pagefaults.
https://t.co/grZeZ4saqT