BlackArrow

BlackArrow - offensive driven defense
#redteam #threathunting by @Tarlogic

[BlackArrow @BlackArrowSec]

All materials from BlackArrow’s talks are now available in our GitHub repository.

➡️ https://t.co/tf82hls411

[BlackArrow @BlackArrowSec]

Microsoft has addressed a one-click NTLM leak vulnerability affecting Windows Snipping Tool (CVE-2026-33829), discovered by our researcher Marcos Díaz (@Calvaruga).

➡️ Read the write-up: https://t.co/JvMGad5NuI
➡️ Microsoft bulletin: https://t.co/0IbpRxxUY7

[BlackArrow @BlackArrowSec]

On our way to Switzerland 🇨🇭, where tomorrow @ineesdv will present our research at @1ns0mn1h4ck on abusing calendar invite processing in modern email clients.

➡️ Read more: https://t.co/QZshm6dj9t

[Insomni'hack @1ns0mn1h4ck]

Phishing now happens in meetings as well? @ineesdv say yes! Understand how attackers exploit collaboration tools with this new #Insomnihack talk.

Buy your ticket now: https://t.co/bbqXz3yzmO

#InsomniHack #Cybersecurity #INSO26

[BlackArrow @BlackArrowSec]

Just over 24 hours until @_kripteria takes the stage at @h_c0n to revisit the design and methodology of attack graphs in Active Directory, showcasing new approaches with Neo4LDAP.

[BlackArrow @BlackArrowSec]

Meetings You Didn’t Plan, But We Did

In this post, @ineesdv breaks down how calendar event processing in Outlook and Gmail can be abused to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction

➡️Read more: https://t.co/7RApljHair

[BlackArrow @BlackArrowSec]

Kudos to our colleague @_Kudaes_ , who yesterday delighted us at @NavajaNegra_AB with his talk 'Activation Context Hijack,' which can be rewatched here: https://t.co/oP6F2U46CJ

[BlackArrow @BlackArrowSec]

This Thursday, our colleague @_Kudaes_ will be at @NavajaNegra_AB presenting Activation Context Hijack: a new code execution technique for Windows environments.

➡️ More info: https://t.co/KLCb6lWNDw

[BlackArrow @BlackArrowSec]

Are you aware that even with App-Bound Encryption, attackers can still attempt to steal browser cookies?

Our #ThreatHunting team explains how the technique works and how to detect it.

➡️ https://t.co/kqLpt1hJDv

[BlackArrow @BlackArrowSec]

AvePoint has fixed a vulnerability in DocAve, Perimeter and Compliance Guardian discovered by our researchers @m1ntko and @Calvaruga.

This vulnerability can be used to achieve Remote Code Execution (RCE) in affected systems.

➡️ Advisory: https://t.co/bD9hLomlG1

[BlackArrow @BlackArrowSec]

Are you aware that WebDAV and search-ms can trick users into executing remote files as if they were local?

Our #ThreatHunting team breaks down how the technique works and how to detect it.

➡️ https://t.co/3pNhCwpgWz

[EuskalHack @EuskalHack]

¡No parpadees si no te lo quieres perder! Kurosh Dabbagh nos habla de "Call Stack Spoofing para ocultar la ejecución de implantes desde memoria" #WindowsInternals #Malware #EDR @_Kudaes_

[BlackArrow @BlackArrowSec]

In a few hours, our colleague @_Kudaes_ will talk at @EuskalHack about call stack spoofing to hide the execution of implants from memory. #ESCVII

➡️ Read more: https://t.co/oC13XL8qAF

[BlackArrow @BlackArrowSec]

Are you aware of this technique for achieving fileless persistence?

Find out how it works and how to detect it.

➡️ https://t.co/ku1bzDg8fN

[Kurosh Dabbagh @_Kudaes_]

Although it's nothing new, @ineesdv and I are pleased to publish our own ROP-based implementation of the code fluctuation technique. We've tried to keep it simple and functional, avoiding to use common features like Timers, HWBP or APCs. https://t.co/sm2O310XNg

[BlackArrow @BlackArrowSec]

Our colleagues @_Kudaes_ & @ineesdv will be at #HackOn2024 presenting an alternative approach to ROP-based sleep obfuscation technique to evade memory scanners.

➡️ Read more: https://t.co/stknNHL5Zd

[BlackArrow @BlackArrowSec]

Enhanced version of secretsdump from #Impacket to dump credentials without touching disk.

This feature takes advantage of the WriteDACL privileges held by local administrators to provide temporary read permissions on registry hives.
https://t.co/gRtlOdNejE