💥 2026 - here we go! I am excited to announce the release of "Linux Attack, Detection, and Live Forensics v2.0 - Hands-on Purple Teaming Playbook"! In this fully hands-on guide, I've leveled up the Linux-oriented purple teaming experience to bridge the gap between red and blue teams like never before:
- 💙 Focus on cutting-edge research and development of Linux offensive techniques -> empowering blue teams to understand and anticipate real-world Linux threats.
- ❤️ Dive into the detection perspective, explore corresponding events, telemetry, evidence, and chained detections -> giving red teams the insights to refine their Linux evasion strategies.
- 💜 Map it all to expected EDR/Runtime functionalities and DFIR processes, fostering true collaboration for purple teaming excellence.
The link is here: https://t.co/SUktIBXgHt
Check out GoLinHound:
- Discovers Linux & SSH attack paths
- Outputs OpenGraph JSON for BloodHound ingestion
- Integrates with SharpHound and AzureHound data to unveil cross-technology attack paths
https://t.co/HPh2xiiCzl
Watch the replay of VeloCON 2023 on our YouTube channel. You can relive the entire conference or watch any individual presentations you may have missed.
https://t.co/3yrHOYHAfc
My latest North Korea research with @martyn_williams is now publicly available: https://t.co/SdURXMxPj7 Also added it to the DB: https://t.co/HRCQcgvcZz
Did you know that it is possible to read memory using a PROCESS_CREATE_PROCESS handle? Just call NtCreateProcessEx to clone the target process (and its entire address space), and then read anything you want from there.😎
Lately, two new tools for dumping the lsass process have come up: HandleKatz and nanodump 👀
I've integrated them to CrackMapExec as module:
1⃣ -M handlekatz
2⃣ -M nanodump
3⃣ -M procdump (as bonus 😝)
(dmp parsed by pypykatz from @SkelSec )
Available on @porchetta_ind 🪂
Threema does not have forward secrecy (https://t.co/WZKvpI6gx6) and local keys are stored insecurely. DROPPED from https://t.co/9O7m8Nq3XB. Stay safe. #privacy#COP26
Need to go under the radar downloading #mimikatz (and other suspect payloads)? Then newly discovered #lolbin "C:\Windows\System32\Cmdl32.exe" (signed by MS) is for you. It's like a new certutil.exe but absolutely unheard of by any antivirus software!
In case you want to see something cool about CrackMapExec and Responder 😌😋
1⃣ cme smb <ip> -u user -p pass --shares
2⃣ Responder -I eth0
3⃣ cme smb <ip> -u user -p pass -M slinky -o ...
Harvest ntlmv2/v1 credentials in no time if you have write access to a share 🔥
🪂
For a compromise assessment of #Exchange servers I recommend using our free THOR Lite scanner
We've added all rules & IOCs relevant to #ProxyShell exploitation & update them frequently
THOR Lite
https://t.co/gG1xDLRnjz
YARA rules
https://t.co/j6k4ydJd4i
https://t.co/pJiVhY0f10
I've published my first 'Gist' combining several well known techniques to accomplish Windows workstation takeover in a default Active Directory Configuration. SMB writeable shares are spicier than ever. 🌶️
https://t.co/feS1Cs6GaJ
yarh- for some reason on win11 the SAM file now is READ for users.
So if you have shadowvolumes enabled you can read the sam file like this:
I dont know the full extent of the issue yet, but its too many to not be a problem I think.