T045T3R

Just T04ST!Ng some cpus

[T045T3R @T045T3]

@omb_ai Done

[T045T3R @T045T3]

@grok @Anon27679969 @gnwb199 @FAbudaoud @tubbiie_ @SuYuxiang63667 @hot_aunty_h @laihu272526 @DengM98651 @leave_theriches @kkkkkk85696472 @sOliveiraCoelho @AllWEALLARE @BrrstOS @abudonovan @ayzakhan761 @HuZiGeGe752 @castlejskull @WowAToast @miagranger112 @isabell53646565 @dsdsdsds157566 More

[T045T3R @T045T3]

@VanzQtb Code

[T045T3R @T045T3]

@MarcOverIP @_xpn_ Truly a shame. NL song was legit awesome. Also giving dj Paul and hakken it's place is a cultural asset missed.

[T045T3R @T045T3]

@_xpn_ Seriously isn't anything else more important to them 😅

[T045T3R @T045T3]

#redteam #itsec #maldev #c

[T045T3R @T045T3]

Have you watched my talk on #DirectSyscalls and #InlineAssembly
At @IntentSummit yet? Check it out :
https://t.co/o6w7CAWAzC

[T045T3R @T045T3]

To all @IntentSummit attendees, see you Sunday !
@CyberArk @Checkmarx #evasion #maldev #infosec #redteam #EDR

[T045T3R @T045T3]

One of my favorites from our latest research

[Spiky Sabra @SpikySabra]

So we showed you how we use vulnerable drivers to steal tokens for a new process.
That is obviously not enough.
How about editing your current process token?

Check this:

https://t.co/8RrkzYf9Zj
https://t.co/pFjMdvsLt0

[T045T3R @T045T3]

No token is safe 😈

[Spiky Sabra @SpikySabra]

Access tokens are the beating heart of a process.
stealing tokens is an important method attackers need in order to escalate their privileges.
What if you could steal both local and AD tokens with one command line?

Well..now you can !
Check this out :

https://t.co/8RrkzXX0Lb

[T045T3R @T045T3]

Killing an EDR? NO PROBLEM!

[Spiky Sabra @SpikySabra]

A lot has been said about removing hooks and kernel callbacks to stop an EDR from detecting malicious activity.
What if we could terminate the process completely?
Well ...we can.
Check this out:

https://t.co/8RrkzXX0Lb

[Spiky Sabra @SpikySabra]

PPL can be very pesky when you try to dump some creds.
Sometimes all you wish for is to turn it off with a click of a button.
Well... Your wish is our "command".
Want to know how?
Click this:
https://t.co/8RrkzXX0Lb

[T045T3R @T045T3]

Feeling proud.
Our latest research is out now!
Enjoy the read, test the code, and let us know your thoughts!

[Spiky Sabra @SpikySabra]

Bring Your Own Vulnerable Driver.
Just two weeks since we learnt how the infamous Lazarus group has carried major cyber attacks using CVE-2021-21551.
What if we could re-create that code?
what about mitigations ?
Check out our latest research and repo:
https://t.co/8RrkzYf9Zj

[T045T3R @T045T3]

@SecYuriG @PaloAltoNtwks @0xs0ns3 Nah..not today

[T045T3R @T045T3]

@4d616f722048751 @PaloAltoNtwks @0xs0ns3

[T045T3R @T045T3]

@Bl00dyHy3na @0xs0ns3 Can't wait to show everyone

[T045T3R @T045T3]

@hasamba @PaloAltoNtwks @0xs0ns3 טוסטר משולשים 🤣

[T045T3R @T045T3]

@Yossi_Sassi @PaloAltoNtwks @0xs0ns3 Oopsie poopsie

[T045T3R @T045T3]

@yuhan4cyber97 @PaloAltoNtwks @0xs0ns3 We are just helping them to stay up late so they can make more of their day

[T045T3R @T045T3]

@MalFuzzer @0xs0ns3 And he's got a friendly T045T3R with him to do so 😈