sh4hin

Threat Emulation/Hunting | Linux/Mac enthusiast

[sh4hin @s3cdev]

I have recently developed a tool which consists of 13 different shell code injections to evaluate endpoint detection capabilities. All credits go to @Ne0nd0g @_D00mfist @C__Sto @_batsec_ @spotheplanet for their amazing works that inspired me to do it.
https://t.co/Zq1SkbpKS2

[sh4hin @s3cdev]

@vxunderground @mrd0x @MalDevAcademy 👍

[sh4hin @s3cdev]

@scada_plc 👍 great idea

[sh4hin @s3cdev]

@0xcc00 Thanks for the great work on this PoC. I’m facing an issue ,the command output isn’t showing in the Gemini console, and it can’t detect live beacons. Not sure if I’m missing something. Happy to continue here or via DM

[sh4hin @s3cdev]

@arcanuminfosec 👍

[sh4hin @s3cdev]

@DebugPrivilege Good luck 👍

[sh4hin @s3cdev]

@djnn1337 Thanks, it was while back and the codes should be rewritten 😁

[sh4hin @s3cdev]

@djnn1337 Great job

[sh4hin @s3cdev]

@AliceCliment Great job

[Matt Zorich @reprise_99]

In nearly all of our on-premises engagements, a threat actor has taken total full control of Active Directory. If you are interested in the kind of things @MicrosoftDART finds, and how we recommend you secure Active Directory, then this blog is for you - https://t.co/D7fdIbsUn0

[sh4hin @s3cdev]

@cyb3rops BackgroundHost.exe

[Matthew @embee_research]

Reverse Engineering a #CobaltStrike #malware sample and extracting C2's using three different methods.

We'll touch on #cyberchef, #x64dbg and Speakeasy from fireeye to perform manual analysis and emulation of #shellcode.

A (big) thread ⬇️⬇️
[1/23]

[diversenok @diversenok_zero]

I'm happy to share the results of months of research on code injection, process tampering, and their detection! 🥳

Here you'll find technique categorization, a dive into the underlying OS mechanisms, sample demos, detection suggestions, and much more:
https://t.co/KZyI0PKlPz

[Moritz @m_r_tz]

Check out capa v4 with:
1. support for analyzing .NET executables
2. finer grained capability detection via instruction and operand features
3. many new and updated detection rules
Blog: https://t.co/0WPjK5jKNI
Binaries: https://t.co/QPpiGZgtap
Source: https://t.co/gWbLkjgYG9

[sh4hin @s3cdev]

@zux0x3a Nice 👍

[sh4hin @s3cdev]

@Antonlovesdnb @SumoLogic Good luck

[sh4hin @s3cdev]

@runasand @flipper_net @nieldk :)

[sh4hin @s3cdev]

Great book, Well done!

[hAPI_hacker @hAPI_hacker]

@rahi_sec The ebook is currently available here
https://t.co/dvGw3JaB8X

[S3cur3Th1sSh1t @ShitSecure]

NimGetSyscallStub is now public, the first public fully working (didn't find another myself) Nim imlementation + PoC to grab fresh Syscalls from disk on runtime:

https://t.co/E6NjcWviAm

@chvancooten even with a yara rule (with your template 🤓)

[sh4hin @s3cdev]

@nas_bench Nice 👍