Two Seven One Three

Chief Security Officer (CSO) || Security Researcher at || Penetration Tester || Red Teamer || Social Engineering Awareness Trainer

[Two Seven One Three @TwoSevenOneT]

Some powerful built-in Windows 11 programs are allowed to write files to Defender’s working directory:
\System32\msiexec.exe
\Register-CimProvider.exe
\svchost.exe
\lsass.exe
Tools and methods to find these whitelisted programs for other #antimalware
Github: /TwoSevenOneT/DefenderWrite

[Two Seven One Three @TwoSevenOneT]

Challenge: Drop #mimikatz onto a drive with the latest Windows 11.
1. Found a way to write a file into Windows Defender’s working directory: Success ✅
2. Dropped "mimikatz.exe" into that folder: Failed 🛑
Conclusion: Windows Defender does not exclude its own executable folder

[Two Seven One Three @TwoSevenOneT]

@DXevj7ck The purpose is to prevent EDRs from connecting to their servers, with low user privs

[Two Seven One Three @TwoSevenOneT]

While I was trying to evade cloud-based EDRs, I accidentally found a way to temporarily block a client's machine network with a POC running as a Normal user.

Not using the Windows Filtering Platform (WFP) which requires Admin priv
I haven't thought of exploitation scenarios for this tool yet, it might be a dead-end #antimalware research direction 🤔
#redteam

[Two Seven One Three @TwoSevenOneT]

@_hackscale_ @FaithWa76789087 As soon as possible 😁

[Two Seven One Three @TwoSevenOneT]

@FaithWa76789087 Sure 🤗

[Two Seven One Three @TwoSevenOneT]

@Abdulmalik_TTG Why not 🤭
All information has value.

[Two Seven One Three @TwoSevenOneT]

Need to survey which Antivirus product to prioritize bypassing

[vx-underground @vxunderground]

Had a Threat Actor ask for an anti-virus recommendation

DAWG, YOU ARE THE THREAT. WHY DO YOU NEED AN AV?

[Two Seven One Three @TwoSevenOneT]

@huntnp007 Yep, Mimi when you want to check whether an exec malicious behavior triggers an alert or not.
It's just a quick check.

[Two Seven One Three @TwoSevenOneT]

To be honest, in many cases I test evasion or antivirus bypass by dropping #mimikatz onto the Desktop and running it to see if it works.
I don't use the EICAR test file 😂
Drop Mimikatz and the AV doesn't complain ==> something's worked

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Want to feel #hacker but fear to put #mimikatz binary on your desktop?

[Two Seven One Three @TwoSevenOneT]

@HolyMoly84103 Safer than "real" hackers, the ones who test payloads with VirusTotal ;)

[Two Seven One Three @TwoSevenOneT]

@gentilkiwi Yep😆

[Two Seven One Three @TwoSevenOneT]

@HonkyTonkHer0 Yep, this is just a quick way to check

[Two Seven One Three @TwoSevenOneT]

@r3dactt Be on the same page 😁

[Two Seven One Three @TwoSevenOneT]

They work harder than the sysadmin team to confige users' machines 🤣

[blackorbird @blackorbird]

BlackSanta EDR-Killer Operations
https://t.co/irJSN1BjbZ

[Mr.Z @zux0x3a]

I am releasing a new toolkit I built for IIS-based lateral movement and code execution within IIS worker pool process's memory.

Phantom ASPX Loader & PhantomLink -- a two-part toolkit for reflectively loading native DLLs into IIS w3wp.exe worker processes via ASPX.
https://t.co/EevQysfANT

[Tim Blazytko @mr_phrazer]

Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.

Here's the release: https://t.co/HU2Vf8Uj6T

[Clandestine @akaclandestine]

GitHub - 0xsh3llf1r3/ColdWer: Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass https://t.co/5YLoC9VuNF

[Two Seven One Three @TwoSevenOneT]

@7uckzero Yes, what's important is how we make a valid service "crash". If we use a custom payload to trigger it, then the failure recovery function isn't very useful anymore.

[Two Seven One Three @TwoSevenOneT]

You can exploit the Service Failure Recovery feature of Windows Service to execute a payload without ever touching the ImagePath.
#antimalware #redteam #Pentesting