dejisec

Mastering both sides of The Force like Darth Plagueis

[pfiatde @pfiatde]

Did you know, that instead of killing the Windows Defender process, you can remove the signatures (requires local admin privs)?
After that you can do pretty much what you want, e.g. downloading & running mimikatz.

Here is a small PoC, I made for @cyvisory

[0xor0ne @0xor0ne]

How to modify Meterpreter dropper to bypass EDRs
Excellent blog post by @VirtualAllocEx

https://t.co/S2kQpHWSAP

#meterpreter #redteam

[Florian Roth ⚡️ @cyb3rops]

Low Level Malware Protection

1. Use web proxies 🌉
(proxy awareness in all malware stages is rare)

2. Block executable downloads 🚦
(from unclassified domains; stage 2+ is often executable content)

3. Restrict workstation to workstation communication 🚧
(contains an outbreak)

[Florian Roth ⚡️ @cyb3rops]

LSASS Memory Dumps are Stealthier than Ever Before Part 2 https://t.co/Zs9h7eVdmb

[Dirk-jan @_dirkjan]

There seems to be quite some questions and confusion about the impact of exploiting Zerologon (CVE-2020-1472) on the environment. So here's a thread 👇

[Chris Sanders 🔎 🧠 @chrissanders88]

Look at this slice of awesome. The new Wireshark version in dev (3.3.0) has a packet diagram view.

A fantastic teaching and learning tool! When released, I'll be making pretty extensive use of this in my classes! Great job @geraldcombs and @WiresharkNews team.

[Inti De Ceukelaire @securinti]

Here are the slides: https://t.co/XGsapgJoqm
@NahamSec will upload the video after the conference
#NahamCon

[Nicholas DiCola @MasterSecJedi]

Using @github Enterprise?? Want to monitor it for #Security in #AzureSentinel? Itay Argoety, @rubin_mor and I just shared how you can do it!!!

https://t.co/T2mG5JJuNf

[dejisec @dejisec]

Verifying myself: I am dejisec on https://t.co/iY2MWBOrq9. s47815vn2Nbh9Y9_C-AZsJGhQwgYDp8MR8Y1 / https://t.co/6Zwd21pJRk

[Inti De Ceukelaire @securinti]

Finished my talk for #NahamCon tomorrow, what you can expect:

• Two 0-click account takeovers on popular bug bounty programs
• A common XSS vector in e-mail providers
• A vulnerability in @intigriti's e-mail forwarder
• An #OSINT trick to unmask cybercriminals
• Blind RCE