I have recently developed a tool which consists of 13 different shell code injections to evaluate endpoint detection capabilities. All credits go to @Ne0nd0g@_D00mfist@C__Sto@_batsec_@spotheplanet for their amazing works that inspired me to do it.
https://t.co/Zq1SkbpKS2
@0xcc00 Thanks for the great work on this PoC. I’m facing an issue ,the command output isn’t showing in the Gemini console, and it can’t detect live beacons. Not sure if I’m missing something. Happy to continue here or via DM
In nearly all of our on-premises engagements, a threat actor has taken total full control of Active Directory. If you are interested in the kind of things @MicrosoftDART finds, and how we recommend you secure Active Directory, then this blog is for you - https://t.co/D7fdIbsUn0
Reverse Engineering a #CobaltStrike#malware sample and extracting C2's using three different methods.
We'll touch on #cyberchef, #x64dbg and Speakeasy from fireeye to perform manual analysis and emulation of #shellcode.
A (big) thread ⬇️⬇️
[1/23]
I'm happy to share the results of months of research on code injection, process tampering, and their detection! 🥳
Here you'll find technique categorization, a dive into the underlying OS mechanisms, sample demos, detection suggestions, and much more:
https://t.co/KZyI0PKlPz
Check out capa v4 with:
1. support for analyzing .NET executables
2. finer grained capability detection via instruction and operand features
3. many new and updated detection rules
Blog: https://t.co/0WPjK5jKNI
Binaries: https://t.co/QPpiGZgtap
Source: https://t.co/gWbLkjgYG9
NimGetSyscallStub is now public, the first public fully working (didn't find another myself) Nim imlementation + PoC to grab fresh Syscalls from disk on runtime:
https://t.co/E6NjcWviAm
@chvancooten even with a yara rule (with your template 🤓)