HBK

Windows Security Researcher

[HBK @HBK647]

@pubqypcnguins @resmaliks @DegenerateNews @binance @pudgypenguins Send my sol back

3ByLmhLKaHTZJ1qArr1vJpUoSiSRDGJR41oDU2tgDKfK

[HBK @HBK647]

@DegenerateNews @pudgypenguins @binance Send my sol back

3ByLmhLKaHTZJ1qArr1vJpUoSiSRDGJR41oDU2tgDKfK

[HBK @HBK647]

@pudgypeniguins @intelio_ntelno @DegenerateNews @binance @pudgypenguins @WhalesMarket Send my sol back 3ByLmhLKaHTZJ1qArr1vJpUoSiSRDGJR41oDU2tgDKfK

[MalDev Academy @MalDevAcademy]

Update 3 out now: https://t.co/yjREfLSDGS

- Event Tracing for Windows - Introduction
- Event Tracing For Windows - ETW Tools
- Event Tracing For Windows - ETW Bypass Via Byte Patching
- Event Tracing for Windows - Better Patching
- Event Tracing for Windows - Patchless ETW Bypass Via HBPs
- Event Tracing For Windows - ETW Provider Session Hijacking

[Joe Desimone @dez_]

⚡️Screenshot.img -> Screenshots.lnk https://t.co/ypk9dnxfS3

📒 NEW DLL Side Load via Microsoft.SharePoint.NativeMessaging.exe

🏃Run key persistence

👪Family - UKNOWN?

[HBK @HBK647]

F

[Austin @YouDownWithTTPs]

If you collect detailed file share events and have not seen or used this search before, I highly recommend that you run it on Monday morning. Low FP rate and it will find much more than PetitPotam. Ben0xA/Random_Splunk_Detections · GitHub https://t.co/CYQARQddUh

[Joe Desimone @dez_]

Interesting macro download technique with findstr+webdav
https://t.co/fX9DOxXp68

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Unable to extract credentials via DPAPI or Mimikatz? Don't worry. Microsoft got your back. Just use 'rundll32 keymgr.dll, KRShowKeyMgr' to extract all the stored passwords on the host, be it a target server, FTP or chrome's HTTP creds, microsoft has you covered. #redteam

[Samir @SBousseaden]

a ProcessAccess GrantedAccess value (0x1/PROCESS_TERMINATE ) you may want to add to your sysmon config to detect suspicious process termination of "security/sensitive" processes (correlate sysmon 10 with 5)

https://t.co/9zeqE7dRwL

[Florian Hansemann @CyberWarship]

PR0CESS/miniGhosting at main

#infosec #pentest #redteam
https://t.co/azys6DSYKO

[Alexandre Cheron @axcheron]

New technique for shellcode injection to evade AVs and EDRs https://t.co/pY5dNSP4lj

[mr.d0x @mrd0x]

Anyone else aware that .asd files can contain macros? Literally just found out.

Added to Filesec:
https://t.co/jKxvH30NDG
https://t.co/h3aa3Em96A

[Florian Hansemann @CyberWarship]

Go365: An Office365 User Attack Tool

#infosec #pentest #redteam
https://t.co/ID89BaK8Wn

[Nicolas Krassas @Dinosn]

BloodyAD is an Active Directory Privilege Escalation Framework

https://t.co/XCHLNhLH6f

[Dipam @virtusleo_]

One of the best cheatsheet I got ❤️
Thanks @therceman

#log4j #log4jRCE #log4jshell #hacking #cybersecurity #Hackers #CyberAttack #SecurityBreach

[Joe Słowik 🌻 @jfslowik]

One thing that continues to add complexity to #log4j discussions is that the external-facing server receiving the exploit attempt is NOT NECESSARILY the server exploited depending on remote logging, etc.

[mr.d0x @mrd0x]

Procdump dump lsass
Defender: Threat detected!

Sqldumper dump lsass
Defender: Sure, go right ahead!

btw dumping lsass with sqldumper.exe is not new, actually its quite old. https://t.co/Q6HCfHeDJX

[markus neis @markus_neis]

Nice overview by @GovCERT_CH on current #log4j https://t.co/SHpRNCk7Fi

[mr.d0x @mrd0x]

LOLBIN(s): mpiexec.exe & smpd.exe
Path: C:\Program Files\Microsoft MPI\Bin

mpiexec.exe spawns smpd.exe which then spawns an executable.

Usage: mpiexec.exe -n 1 c:\path\to\binary.exe

(1/2)