Manifold operations

Manifold Operations is a specialized cybersecurity research and engineering firm.

[Manifold operations @manifoldops]

Most security controls are deployed on assumption. Very few are measured.

When an attack occurs, does the telemetry sensor observe the state change, or does it drop the event in the noise? Visibility without verified timing is merely hope.

#manifoldoperations #computersecurity

[Mr Low-Level (0x3xp) @0xmrlowlevel]

It’s a custom loader. 0 imports. The IAT haven’t contains anything for heuristic detection Even no CRT imports. This loader works custom entry point + Indirect syscall + API hashing + return stack spoofing + more evasion techniques.

Follow: https://t.co/1FCtK5Rsdl

#malwaredev

[Mr Low-Level (0x3xp) @0xmrlowlevel]

Abused SetupIterateCabinetW MsgHandler callback to redirect execution flow. No CreateRemoteThread needed.

Full PoC + writeup:

https://t.co/lWATTZtE0D

#RedTeam #MalwareDev #EDRBypass

[Mr Low-Level (0x3xp) @0xmrlowlevel]

Don’t use GetModuleHandleA/W to get base address of ntdll.dll. Try PEB walking instead.

#windows #EDRBypass #WindowsInternal #pebwalking #lowlevel #assembly

[Mr Low-Level (0x3xp) @0xmrlowlevel]

Check after 12 hours on GitHub for full source code + binaries.

[Mr Low-Level (0x3xp) @0xmrlowlevel]

Main features of Lethe. It can do Token steal, Kill EDR callbacks, Dump lsass from kernel level. No user mode threads. Using KTIMER+DPC as primary execution engine.

#lethe #driver #windows