Petar Jr. Pranic

Windows Detection Engineer @SentinelOne
Opinions are my own

[Petar Jr. Pranic @ipSlav]

My first research and tool are finally out. If you want to deep dive into some CLR internals and understand how we can abuse it to blend-in within its own logic go check it out. Hope you'll enjoy the read.
https://t.co/FegHkegEE9

[Petar Jr. Pranic @ipSlav]

@KlezVirus Sensei 🔥

[Petar Jr. Pranic @ipSlav]

@GabrielLandau Great research and post! I would really love to see someone do LPE by exploiting some userland apps 😬

[Petar Jr. Pranic @ipSlav]

@Defte_ Stumble on this on an engagement a while back. IIRC using Shadow Copy allows you to retrieve the files despite the opened handle. Not the most opsec way of doing it but it's doable. Duplicating the process handle might be another suitable way of doing it, never tried it tho.

[Petar Jr. Pranic @ipSlav]

@SBousseaden Amazing and very neat work guys! I'm not super happy on seeing TAs using my own DirtyCLR but I suppose that's the drawback of publishing new research/techniques. Sooner or later I'll have to figure out some possible detection against it 🙃

[Petar Jr. Pranic @ipSlav]

@HackingLZ https://t.co/gsvP7OSxXB
Seems pretty good

[Petar Jr. Pranic @ipSlav]

@AndrewOliveau @Mandiant Great read and technique, it's super nice to see AppDomainManager Injection be used in so many different flavors. It's an old technique yet it's still so easily overlooked and with so much potential for further abuses that is mind-boggling if you ask me.

[Petar Jr. Pranic @ipSlav]

@bohops This made me laugh more than it should

[Petar Jr. Pranic @ipSlav]

@_xpn_ Personally Typora + GitHub prv8 repo > Notion. But I think it's a matter of personal taste.

[Petar Jr. Pranic @ipSlav]

@AnthonySecurity @mariuszbit On AzureAD/EntraID @_dirkjan course is one of the best out there IMO.

[Petar Jr. Pranic @ipSlav]

@Antonlovesdnb @techyteachme @techspence This. Plus installing GOAD and read/practice tons of techniques also from dirkjanm and spectreops blogposts.

[Petar Jr. Pranic @ipSlav]

@DebugPrivilege Wow, mind if I DM you for a couple of questions? Will need a temp follow as I'm not verified 😬

[Petar Jr. Pranic @ipSlav]

@techyteachme @medarkus_ Thanks Zack, appreciated! Definitely on the right track then :)

[klez @KlezVirus]

6 months before @porchetta_ind's events unfolded, I paused updating my FOSS tools, questioning their value. To rediscover this and shape future developments, I've opened a private server for ppl to share ideas or even just connect.
Interested? Join! https://t.co/muWpPJ0HPd

[Petar Jr. Pranic @ipSlav]

Also, biggest shoutout of all to @ShielderSec whose sponsored this research and made all of this a reality! Not every company allows you to do that, so if you want to uncover new stuff with us please reach out 🔥

[Petar Jr. Pranic @ipSlav]

My first research and tool are finally out. If you want to deep dive into some CLR internals and understand how we can abuse it to blend-in within its own logic go check it out. Hope you'll enjoy the read.
https://t.co/FegHkegEE9

[Petar Jr. Pranic @ipSlav]

Thanks everyone for the amazing replies, I'm flabbergasted by them.
I wanted to thanks my friends @Her0_IT, @Void_Sec, @KlezVirus and @naksyn for their support and peer-review on this blogpost.

[Petar Jr. Pranic @ipSlav]

Huge credits to @MrUn1k0d3r , @_xpn_ , @_ForrestOrr , @daem0nc0re and @d_tranman for their previous researches and PoCs.

[Petar Jr. Pranic @ipSlav]

@Cyb3rMonk @BluRavenSec Really hope to win and dive right into it, you know how much I am interested in Detection Engineering :)

[Mehmet Ergene @Cyb3rMonk]

🎁 GIVEAWAY TIME! 🎁 - I'm giving away 2 seats for my brand new "Hands-On Kusto Query Language (KQL) for Security Analysts" course!

Please follow @BluRavenSec , Comment, and Repost to participate.

👉 https://t.co/qoSTNy22HM

Two random winners will be announced on 5 December 2023.

#kql #microsoftsentinel #microsoftdefender #microsoftxdr #threathunting #dfir #detectionengineering