RistBS

🇫🇷 maldev enjoyer & windows internals explorer | 🏆 Offshore & APTlabs

[RistBS @RistBs]

@yarden_shafir here's a good one, it's https://t.co/6rv51XtkLn by @real_redp

[RistBS @RistBs]

@0xEr3bus @_0xDeku nice work 👍

[dennisbabkin @dennisbabkin]

Windows Authentication - Credential Providers - Part 1 - A primer on writing a credential provider in Windows. https://t.co/OV5p7jliik

[RistBS @RistBs]

@aahmad097 very nice project, I brought a PoC based on the same concept a while ago but with only ContextMenuHandlers shell extension

[Zohdy @7odaZohdy]

My latest blog I worked on “Hunting for A New Stealthy Universal Rootkit Loader”, We discovered a threat actor we believe is the same actor behind FiveSys is actively abusing WHQL portal for signing 75 kernel drivers in 2022/2023.

https://t.co/Rh5qJT1FwN

[RistBS @RistBs]

I confirm that we can use NtCreateWorkerFactory to execute our shellcode, it's just another way to do it :D

https://t.co/kbAYKqtcZh

[RistBS @RistBs]

@Jhaddix Thank you for that, I appreciated it 😼

[RistBS @RistBs]

I have updated the Win32 offensive #cheatsheet with more techniques such as :
- Module Stomping
- Process Instrumentation Callback
- Heap Encryption
- Sleep Obfuscation

#malware #redteam #cybersecurity

https://t.co/7BFxOUYR3d

[RistBS @RistBs]

@Imghostfaceee @0gtweet this should work if you use EtwEventWriteNoRegistration like 0gtweet said 🙂

[RistBS @RistBs]

@q8fawazo @NinjaParanoid anyways, I give them both credit for their work.

[RistBS @RistBs]

new post released! Learn how I hijacked the explorer context menu to execute my beacon at each right click on a file/folder -> https://t.co/RDetsdDqv7

#malware #redteam #cybersecurity

[RistBS @RistBs]

@q8fawazo @NinjaParanoid no I don't have access to his training it's too expensive 🥲 but I helped myself a lot from this repo available on github https://t.co/tH9NBBcPe9

[RistBS @RistBs]

It's been a long time since I updated my cheatsheet, here is a small update that contains a list about malware dev. The biggest update is coming soon :) https://t.co/zr6b84EQoO
#malware #redteam #cheatsheet

[RistBS @RistBs]

@_Euzebius thx, glad to hear that😄

[RistBS @RistBs]

I've released a new post about #opsec in #redteam go check it out and give me your feedback!

https://t.co/MXbE2SSHqN

[RistBS @RistBs]

@NUL0x4C @modexpblog the only implementation of the structure I have seen so far is https://t.co/dEJUfwGz6j

[RistBS @RistBs]

@_nwodtuhs @Alh4zr3d So, better calls the ticket that comes after TGS_REP a Service Ticket (ST) instead of TGS

[RistBS @RistBs]

@NinjaParanoid @cyberwabz IDA pro on kernel32/kernelbase/ntdll -> quick filter -> "Callback" and it's stonks :D

[RistBS @RistBs]

@lowleveldesign nice, that's amazing