Panos Gkatziroulis 🦄

Red/Purple Teamer | Blogger | Mod @ |

[Panos Gkatziroulis 🦄 @ipurple]

Who is on BlueSky and active?

[Panos Gkatziroulis 🦄 @ipurple]

Custom Extensions https://t.co/9Q7f7DyJm0

[Panos Gkatziroulis 🦄 @ipurple]

@HackingLZ Maybe because it was not produced for industry implementation but to maintain status, push for PhD etc. Different world, which unfortunately is not connected to the industry, or the industry is not connected with academia.

[Panos Gkatziroulis 🦄 @ipurple]

@0xprashanthSec Mostly IR, but still useful!

[Panos Gkatziroulis 🦄 @ipurple]

Field Notes: Reconstructing an Attacker’s Workflow https://t.co/tXV3Xn4b0v

[Panos Gkatziroulis 🦄 @ipurple]

Adds protected Active Directory binds to synchronous ldap3 connections. It uses:

✅ Impacket for Kerberos and NTLM authentication and leaves LDAP queries, entries, controls, and binary values with ldap3.
✅ It does not require a native GSSAPI library or an ldap3 fork.
https://t.co/tUqbZ9gpZ5

[Panos Gkatziroulis 🦄 @ipurple]

TornadoC2 - A pull-based C2 with ten native transports, concurrent multi-profile handlers, and an honest threat model. The agent is a single Go binary with every behavioural property baked in at build time no runtime config file, no environment variable, no command-line arguments. https://t.co/9hMRh6JL7I

[Detection Dispatch (Alex's Version) @alehurtadoxo]

The video is up on YouTube after a slight delay https://t.co/bi8mmlRSlX

[byteMe @0xby7e_me]

Just open-sourced WinLPEAuditor - a Windows LPE misconfiguration auditor built in C++.

Checks for unquoted service paths, AlwaysInstallElevated, dangerous token privileges, modifiable service binaries, and more. Native binary, no PowerShell, no .NET.

https://t.co/4eNt4kJmWQ

[Panos Gkatziroulis 🦄 @ipurple]

You write a post just to get a reply from an AI bot 😂

[Panos Gkatziroulis 🦄 @ipurple]

@whokilleddb I guess you haven't read my article?
4 binaries related to Text-Template and detection guidelines
https://t.co/XKWgR3oULL

[Panos Gkatziroulis 🦄 @ipurple]

Protecting C2 Traffic in Nim https://t.co/qkZ5EelncN

[Panos Gkatziroulis 🦄 @ipurple]

Signet - a code signing wrapper for Mythic C2. It takes any wrapped agent binary or uploaded file and applies an Authenticode signature via osslsigncode. https://t.co/2j06ziQ9pY

[0x12 Dark Development @Salsa12__]

Local Shellcode Execution via SetupIterateCabinetW

New Medium post, today we are going to explore a shellcode execution technique that abuses SetupIterateCabinet (a Cabinet file enumeration function) to dispatch shellcode through a file callback pointer

https://t.co/ktUCguGPw0

[Panos Gkatziroulis 🦄 @ipurple]

I wrote an article about the technique that was disclosed some years ago by @mrd0x - Custom Extensions, including detection opportunities.

TL;DR: Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious file as a legitimate file or evade Windows SmartScreen.

🖊️ https://t.co/RzLmCRxpnS

[Panos Gkatziroulis 🦄 @ipurple]

@spontiroli Most of my playbooks are stored in Confluence. 😀

[Panos Gkatziroulis 🦄 @ipurple]

A project that uses Confluence as a C2 🧐
https://t.co/RWLe3at9Av

[Panos Gkatziroulis 🦄 @ipurple]

@PandaRE__ I am in a similar situation with all of my VMs.

[Panos Gkatziroulis 🦄 @ipurple]

https://t.co/aJMl5JizzM

[Panos Gkatziroulis 🦄 @ipurple]

You can give me a follow if you're on the social media platform below. Link in the reply⤵️

[The Haag™ @M_haggis]

Grateful for the recent conversations we've had with @techspence and @alehurtadoxo

https://t.co/xe1mKe6zYD

https://t.co/9MUGgQHwoT

Definitely give them a view and a subscribe. Lots more inbound friends