Evangelos

get the job done

[Elastic Security Labs @elasticseclabs]

Microsoft wants EDR out of the Windows kernel. We checked the binaries

They even come with public symbols. Full write-up from @zodiacon : https://t.co/9w3mFPIufM

Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds.

What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues

[Samir @SBousseaden]

New blog post showcasing Elastic Defend deep visibility leveraging call stack enrichment. Call stacks are not only useful for finding known bad patterns, but also for reducing ambiguity in standard EDR events, and easing behavior interpretation.

https://t.co/6MyQraUd7M

[Spiros Fraganastasis @m3g9tr0n]

After working for sometime on it, I am happy to announce my contribution to The Hacker Recipes project of a Mimikatz documentation https://t.co/pbsZkbh6CU.

[Vlad @v1ad_o]

#CVE-2021-40444 - reproduction and re-FUD of this chain is relatively simple, it will make some noise.

[Vlad @v1ad_o]

It is important to thoroughly understand the EPP software in which you entrust your business. Releasing this brief EPP capability assessment cheat/check sheet - suggestions/corrections welcome [ this is a work in progress ]

[Evangelos @lex0tanil]

@m3g9tr0n remember when you used to climb mountains, but now you need to steady yourself to fart? Happy birthday my dude.

[@[email protected] @_staaldraad]

Excited to share a writeup of my latest bug - priv escalation in Postgresql (CVE-2020-25695)

https://t.co/J9GUOXb36c

[Orange Cyberdefense's SensePost Team @sensepost]

Phillipe (@kelipatelipa) looks at how @Cybellum's DoubleAgent (circa 2017) post-exploitation technique can still be used to bypass AV/EDRs & even inject into the AV/EDR processes themselves. Check those sysmon events team Blue! https://t.co/WAdefvp9JW

[Evangelos @lex0tanil]

Stuxnet Analysis from @Amr_Thabet always great to read.
https://t.co/v7rT4nK2rY

[Tanmay Ganacharya @tanmayg]

In-depth analysis of PowerShell-based downloader Trojan sLoad, which uses the Background Intelligent Transfer Service (BITS) almost exclusively as alternative protocol for data exfiltration and most of its other malicious activities

Details: https://t.co/yyQzRNmrt9

[Кириакос Экономоу 🇨🇾🇵🇸 @kyREcon]

#Symantec SEP LPE writeup Part #1 :)

[@[email protected] @_staaldraad]

New write-up:
Command injection is usually mitigated but argument injection is often overlooked.
An example of an argument injection chain leading to code execution: https://t.co/wrPj99j33d

[Ori Damari @0xrepnz]

Everyone knows Driver Signature Enforcement.... 🙃

The problem is: Attackers can load any signed driver and abuse its functionality. For example, the process hacker driver can be abused to dump the memory of lsass.exe.

Read about it in my blog😋

https://t.co/eFkoGJObUo

[Ѻṧαη∂α @OsandaMalith]

MiniDumpWriteDump via Faultrep!CreateMinidump https://t.co/GJd0ZtgVS4 via @OsandaMalith

[Ѻṧαη∂α @OsandaMalith]

Running Shellcode Directly in C https://t.co/5E40uZpPbf via @OsandaMalith

[Ѻṧαη∂α @OsandaMalith]

Converting an EXE to a DLL https://t.co/TDbrLSgL2M via @OsandaMalith

[MDSec @MDSecLabs]

Introducing the Office 365 Attack Toolkit, a new blog post and tool release by @0x09AL https://t.co/qi4uLuLAJR

[@[email protected] @_staaldraad]

CVE-2019-13139 ; command injection in `docker build`: https://t.co/Fsf56a1eLQ

[@[email protected] @_staaldraad]

New blog post up!

Bypassing a Docker AuthZ plugin and using docker-containerd for privesc.

https://t.co/mB3ZTHCJQs

[b33f | 🇺🇦✊ @FuzzySec]

I have released Fermion, an electron application for @fridadotre with integrated Monaco code editor. Check out the repo here => https://t.co/qb4JrNpFwp you can also download a pre-built release package for x64 Windows ❤️💀