thefLink

[🅰🅳🅼 @securityfreax]

Modern C2 implants use sleep masking & metamorphic code to stay hidden. We’re revealing how to unmask them using low-level runtime telemetry (ETW & CPU profiling) live in production including a POC with a lightweight sensor.

My team will be presenting our research at x33fcon:

https://t.co/qhtckSyxx5

[thefLink @thefLinkk]

@GabrielLandau @x33fcon @CaptnBanana Thank you for your feedback :-)

We have seen your impressive work and appreciate you sharing it publicly!

[thefLink @thefLinkk]

@GabrielLandau Leistungsdruck.

[thefLink @thefLinkk]

As presented @x33fcon, this bigger update of Hunt-Sleeping-Beacons allows enumerating pending timers and their callbacks to identify timer-based sleepmasks.

Additional detection ideas included :-)

https://t.co/pqlhQnqMIC

[thefLink @thefLinkk]

Happy to present our team's research @x33fcon together with @CaptnBanana

[🅰🅳🅼 @securityfreax]

We accidently built a Sysmon compatible tool with some neat features on top, like (in)direct syscall detection & more. Without drivers, with less resource footprint & using ETW only.

Curious? My team is presenting at @x33fcon in June.
Come & say hello!

https://t.co/TDjO5hUlIz

[Fabian @testert01]

[RELEASE] EvtPsst a small mute tool developed by me, that abuses exposed SYNCHRONIZE and Token handles in order to get a process handle to the EventLog Process with more access.

Blogpost over the techniques will follow in the next days.
https://t.co/aMDXTJKbof

#redteam

[thefLink @thefLinkk]

Here is a little ETW based tool to play with different IOCs by ImageLoad events.

I feel like proxying Kernel32!LoadLibrary through Ntdll is a very strong IOC. :-)

https://t.co/6sekfLSjOe

[thefLink @thefLinkk]

Here is a ETW based POC to monitor for (some) direct and indirect syscalls. Should find multiple open source implementations trying to avoid userlandhooks.

https://t.co/kUp73Apxcs

[thefLink @thefLinkk]

Today we published a new tool to tamper with Sysmon.
Uses handle elevation and a SACL bypass to remain difficult to observe using Sysmon itself or Windows Event logs.

https://t.co/OZ4tkgNOAD

[CODE WHITE GmbH @codewhitesec]

Our powerintern @testert01 strikes again, teamed up with @thefLinkk and developed SysmonEnte: a hard to detect attack on Sysmon. Check out our new blogpost: https://t.co/ol4jrl1Ewa

[thefLink @thefLinkk]

Added an attempt to detect suspicious and blocking callbacks of timers to Hunt-Sleeping-Beacons.

Probably detects some C2 using timer callbacks for sleep encryption

https://t.co/Y6EiqMUs3W

[thefLink @thefLinkk]

@codex_tf2 Electron apps in general are fps I believe :(.

[thefLink @thefLinkk]

Just pushed a detection idea for Foliage/AceLdr to Hunt-Sleeping-Beacons.

State Wait:UserRequest is triggered by KiUserApcDispatcher? Probably a Beacon :-)

https://t.co/ro4WETq9Ox

[CODE WHITE GmbH @codewhitesec]

As part of our #x33fcon talk, @invist and @theflinkk release a socks4a proxy leveraging PIC, Websockets and static obfuscation on assembly level 😎 Check it out: https://t.co/uqHNa6j3jQ

[CODE WHITE GmbH @codewhitesec]

Our @thefLinkk and @TjarkRasche will give a workshop tomorrow at @bsidesbud on creating complex offensive tools as PIC. Come and learn about offensive coding techniques, memory artifacts and benefits of coding tools as PIC.

[thefLink @thefLinkk]

Here is my variant of Gargoyle for x64 to evade memory scanners. Fully relies on ROP and PIC without any APC.

Huge thanks to @waldoirc for the documentation.

https://t.co/hPBwMoAd7A

[hasherezade @hasherezade]

the callstack scan was inspired by @thefLinkk's https://t.co/5iHCJXazIr (mentioned in the code: https://t.co/hh2JEYiJO2)

[thefLink @thefLinkk]

Here is another implementation of Hellsgate + Halosgate

It makes sure, that all resolved syscalls go through ntdll.dll by reusing syscall;ret instructions from clean syscall stubs.
https://t.co/MHAAx0abcz

[CODE WHITE GmbH @codewhitesec]

.NET Remoting Revisited – playing around with .NET Remoting led @mwulftange to new insights, some enhancements for @tiraniddo's #ExploitRemotingService, a new universal #YSoSerialNet ObjRef gadget and its counterpart #RogueRemotingServer (1/2) https://t.co/Qt6r7dIslu

[Mr.Un1k0d3r @MrUn1k0d3r]

We are going live tonight at 4 PM EST.

Season 5 episode 1 Tonight we gave a special guest @thefLinkk is going to present offensive PIC for red teamers.

https://t.co/VBA5zaZSS4
❤
#redteam #Pentesting

[thefLink @thefLinkk]

Here is an idea to identify running beacons:

1. Beacons ThreadState often is: DelayExecution
2. Calltrace to NtDelayExecution includes unknown regions

Works also fine against beacons sitting in file backed memory

https://t.co/ro4WETq9Ox