‼️At the end of last year, there was a series of coordinated attacks in Polish cyberspace.
📌Today, our team is publishing a report describing the technical analysis of these events. We show the scheme of operation and the tools used by the attackers.
➡️https://t.co/A7EuPsL12h
This blog post provides an in-depth analysis of #Turla's #Kazuar v3 loader and how it tries to slip past modern defenses:
• Sideloading via MFC satellite DLLs
• Control flow redirection trick (+ POC)
• Patchless ETW and AMSI bypasses (+ POC)
• Extensive COM usage for registry, file and folder operations (+ partial POC)
• Strings encryption (+ IDAPython decryption script)
• Including IOCs and Yara rules
https://t.co/FK8uAq9iyK
THC Release: 🎄Smallest SSHD backdoor🎄
- Does not add any new file
- Survives apt-update
- Does not use PAM or authorized_keys
Just SSHD trickery....adds one line only.
More at https://t.co/zVCLwmbXv2 👌
SSH Tunnels: Port Forwarding on steroids
Yesterday, we talked about Port Forwarding - an old networking trick that makes an endpoint accessible via a different address. Ports can be forwarded with socat & netcat, but there is a much more powerful and ubiquitous alternative: SSH.
If you have Active Directory Certificate Services (ADCS) in your environment, run Locksmith now!
In Active Directory Security Assessments, we have found critical security issues in *most* ADCS configurations.
The great thing about Locksmith is that it doesn't just highlight the security issues in your ADCS environment, but also provides the command to remediate it!
If you're a pentester/red teamer, Locksmith is great for you to provide remediation recommendations to your customers.
https://t.co/vvtBeeMLuR
#ActiveDirectorySecurityTip
The domain Kerberos service account, KRBTGT (https://t.co/T3WOILdFs8), is an important account since it is used to sign & encrypt Kerberos tickets. The account is disabled and the password doesn't change except when moving from Windows 2000/2003 to Windows Server 2008 (or newer).
This is a highly privileged account and if an attacker can gain knowledge of the account's password hash (or password), they can create forged Kerberos tickets (aka Golden Tickets: https://t.co/WMvjSOIpwm).
Most AD forests have this account lingering with old passwords. The KRBTGT account stores two passwords, the current one and the previous one and checks them both to validate Kerberos tickets. This means that to ensure that the KRBTGT passwords are fully changed, the password must be changed twice. If an attacker can capture a DC backup that is as old as one of the KRBTGT account passwords (say 15 years), then they can compromise the environment even if the backup is 15 years old!
We can use the "msds-keyversionnumber" attribute to determine how many times the KRBTGT password has changed. The formula n - 2 works to calculate how many times the password has changed. If this value is 2 it hasn't changed since it was originally set when the domain was created. If the value is 9, then it has changed 7 times (9 - 2 = 7).
Sometimes this value is very large, like 100003. In that case we just use the last digit (3) to calculate the number of times it has changed: n - 2 = 1, so it has changed 1x.
We recommend changing the password once, then waiting at least a week, and then changing the password again. When you set the password, a process on the DC actually changes the KRBTGT password to a fully random password.
PowerShell code to report on the KRBTGT account for the current domain:
$DomainKRBTGTAccount = Get-ADUser 'krbtgt' -Server $DomainDC -Properties DistinguishedName,'msds-keyversionnumber',Created,PasswordLastSet
$DomainKRBTGTAccount | Select DistinguishedName,Created,PasswordLastSet,'msds-keyversionnumber' | Format-Table -AutoSize
#ActiveDirectorySecurityTip
Want to detect Kerberoasting with no false positives?
Setup a honeypot account for detection following the guidance in this article:
https://t.co/2OjBvxbp6R
#ActiveDirectorySecurityTip
🧠 Reverse engineers, your lab just got smarter.
IDA Free 9.1 is now preinstalled in FLARE VM — @Mandiant 's open-source malware analysis environment.
➥ Lightweight static analysis with cloud decompilers
➥ One-click to launch IDA directly
➥ IDA Plugin ecosystem ready to go
Read more about the integration here: https://t.co/yhCulmGAtV
I've been looking at the leaked #Nobitex cryptocurrency exchange Source Code from Predatory Sparrow / Gonjeshke Darande (https://t.co/QphAbbfnhy and related configs) for the whole morning, here's my notes:
🍿THC member on camera. A first. 😅
30 years of hacking - a perspective and a reflection. 📺 👉 Keep Hacking 👈 The next 30 years of hacking start today. ❤️
Here's the decrypted, 2nd stage dex payload of the Android Monokle spyware from this amazing story below: 3613a76be3c6f0d7f6108920cbd4bcedc4c9a4c3607136a747f77f3c099f7322 - on @virustotal: https://t.co/KK05Hq7YfY
UPDATE: #ESETresearch was contacted by one of the possible authors of the Bootkitty bootkit, claiming the bootkit is a part of project created by cybersecurity students participating in Korea's Best of the Best (BoB) training program. 1/2
https://t.co/CZW6Mfm6bK
🚨@SophosXOps completed a 5-year investigation into People’s Republic of China-based groups targeting perimeter devices. Their report, revealing insights into PRC threat actor tactics, harnesses the power of #JCDC partnership to unite cyber defenders. 🙌 https://t.co/3DIPm1hTaP
Some of the details in this story are just crazy. For instance: "Sophos included in its “hotfix" for the hackers' intrusions additional code that would collect more data from customers' devices. That new data collection revealed that a single Sophos device registered in February of 2020 in Chengdu showed signs of early alterations similar to the Asnarök malware. [...] The company went so far as to track down and monitor the specific devices on which the hackers were testing their intrusion techniques, surveil the hackers at work, and ultimately trace that focused, years-long exploitation effort to a single network of vulnerability researchers in Chengdu, China."
Our talk from @defcon is now available! In the presented research, we document every EDR bypass technique used in the wild along with how to detect it using new memory forensics techniques and @volatility plugins. Feedback appreciated!
https://t.co/fWD57fzchj
#DFIR
🚨 #DFIRtips 🚨
Today, during an investigation, I found a registry key that proved to be extremely useful in identifying the execution of a malicious executable: HeapLeakDetection!
You can find it in the Software hive, specifically at HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications.
This registry key is interesting because its subkeys refer to all the executables that have been detected by RADAR technology for real-time memory leak detection.
Each subkey has its own LastDetectionTime which tells us the last time a memory leak occurred and which executable was affected.
Even though it is not particularly well-known, this artifact could sometimes turn your investigation around, especially when the threat actor tries to erase their tracks by deleting the most common artifacts (Prefetch files, evtx logs, etc.)
[screenshots from my test machine]