New Blog Post: PowerShell Exploits – Modern APTs and Their Malicious Scripting Tactics
I’ve just published a new blog where I explore how PowerShell is used in red team operations, especially by advanced persistent threats (APTs), with a focus on evasion.
In the blog, you’ll find:
- A detailed explanation of AMSI (Antimalware Scan Interface) and how to bypass it with PowerShell
- How we can abuse .NET to run PowerShell commands without PowerShell and without getting detected, and how this works
- Methods of AMSI memory patching in C with many practical examples and effective public tools like Invoke-Obfuscation
- How APTs create their own methods to avoid detection by security tools with practical, effective demonstrations
- Practical examples of underused techniques like CLSID hijacking and exploiting lesser-known LOLBins
- Introducing PowerLoad3r: An advanced, evasive malicious PowerShell script loader.
Read it from here -> https://t.co/wG8qzPhswm
"All the techniques and tests are done against Kaspersky EDR, so you’ll get real-world demos :)"
A special shoutout to @0xNinjaCyclone for inspiration.
#redteam #evasion
@bron45737037457@capy_nation They anounced November "Airdrop will be in the next six month"...
Since they changed to goldenEra.. staking.. after the unconfirmed TON of telegram.. but no change on other t-games.. only capybara.. ?! And now the 110% dropped... The loose people trust..
🚀 Capy Fam, Big News!
🎉 A new league is coming, and it’s bringing an amazing prize! 🎉
💰Stand to win $10,000 worth of $TRUMP if you are among the first 10 players to reach the new Capy Trump league! Who’s ready to level up and claim their spot?
Stay tuned, and let’s Make Nations Great Again! 🔥
#CapybaraNation $BARA #Trump #MNGA
Master Web3: Blockchain, Cryptocurrencies, NFTs, and the Metaverse for Free.
Join the world's 1st Web3 MOOC taught by industry experts.
Earn a blockchain-verifiable certificate.
🎄$BARA-mas is here🎄
Celebrate the holidays with our $BARA-mas giveaway and stand a chance to win $50 worth of $BARA! 🎉
How to enter:
1️⃣ Follow @capy_nation
2️⃣ Like and RT this campaign tweet
3️⃣ Hold 1.5M $BARA in your non-custodial wallet by 6 Jan 00:00 UTC
4️⃣ Gain a $BARA-mas role on https://t.co/5e5oGCl8Tq - https://t.co/bQRvuar4Uf
🎟️5 lucky winners will win $50 worth of $BARA each. Join us and have fun with this holiday season event! ☃️
#CapybaraNation
🍊Capybara Nation Meme Contest 🍊
Let’s see your best #CapybaraNation meme! Top 3 best memes will get: $100 USDT each 🤑
Show us your best Capybara Nation or $BARA memes!
How to enter:
1. Follow @capy_nation
2. Like and retweet this post
3. Reply this post with your best Capybara Nation meme with #CapybaraNationMeme
Ends on 18 Dec, 00:00 UTC
Update: The Supra token claim has been pushed to 2:30pm UTC
We know how you excited you are for this, we've all waited very long for this day and we are here to do right by you.
We've encountered unforeseen issues that are taking slightly longer than anticipated to process, and we must get this right to ensure you all have a smooth token claim experience.
With hundreds of thousands of community members' tokens on the line, there is zero room for error here. Don't worry, your tokens are safe and you will be able to claim them to your wallets today.
TGE will still start at 1pm UTC, and the token claim now starts at 2:30pm UTC.
Hang tight tribe, we'll update you here on X if there's any more news. And watch out for the token claim email, we will send them out as soon as it's ready.
Also please beware of any links floating around, never click any link without triple checking its source and url. This is an exciting moment for us all, but please be mindful and careful out there.