π [ SpecterOps @SpecterOps ]
The AD CS security landscape keeps evolving, and so does our tooling. π οΈ
@bytewreck drops info on Certify 2.0, including a suite of new capabilities and refined usability improvements.
π https://specterops.io/blog/2025/08/11/certify-2-0/
π₯ [ tweet ]
The AD CS security landscape keeps evolving, and so does our tooling. π οΈ
@bytewreck drops info on Certify 2.0, including a suite of new capabilities and refined usability improvements.
π https://specterops.io/blog/2025/08/11/certify-2-0/
π₯ [ tweet ]
π₯3
π [ Ilan Kalendarov @IKalendarov ]
My team has found another CVE!
This time on windows, itβs a NTLM credential leakage vulnerability that bypasses Microsoftβs patch for CVE-2025-24054
π https://cymulate.com/blog/zero-click-one-ntlm-microsoft-security-patch-bypass-cve-2025-50154/
π₯ [ tweet ]
My team has found another CVE!
This time on windows, itβs a NTLM credential leakage vulnerability that bypasses Microsoftβs patch for CVE-2025-24054
π https://cymulate.com/blog/zero-click-one-ntlm-microsoft-security-patch-bypass-cve-2025-50154/
π₯ [ tweet ]
π1
π [ eversinc33 π€πͺβο½‘Λ β @eversinc33 ]
As a little follow up, I wrote a small blog post/tutorial on how to reverse engineer windows drivers with IDA - this is aimed at people that newer touched drivers before and covers IOCTL codes, IRPs and some IDA shenanigans with unions.
Enjoy :3
π https://eversinc33.com/posts/driver-reversing.html
π₯ [ tweet ]
As a little follow up, I wrote a small blog post/tutorial on how to reverse engineer windows drivers with IDA - this is aimed at people that newer touched drivers before and covers IOCTL codes, IRPs and some IDA shenanigans with unions.
Enjoy :3
π https://eversinc33.com/posts/driver-reversing.html
π₯ [ tweet ]
π₯11π4
π [ Smukx.E @5mukx ]
Mega Malware Analysis Tutorial Featuring Donut
π https://github.com/PaloAltoNetworks/Unit42-Threat-Intelligence-Article-Information/blob/main/Mega-Malware-Analysis-Tutorial-Featuring-Donut.pdf
TL;DR The purpose of this blog post is to walk our readers, particularly those who are just stepping into
the realm of malware analysis, through our process of analyzing a unique .NET PE malware
that loads.
π₯ [ tweet ]
Mega Malware Analysis Tutorial Featuring Donut
π https://github.com/PaloAltoNetworks/Unit42-Threat-Intelligence-Article-Information/blob/main/Mega-Malware-Analysis-Tutorial-Featuring-Donut.pdf
TL;DR The purpose of this blog post is to walk our readers, particularly those who are just stepping into
the realm of malware analysis, through our process of analyzing a unique .NET PE malware
that loads.
π₯ [ tweet ]
π₯6
π [ Steven @0xthirteen ]
I wanted to find out if you could start the WebClient service remotely, so I ended up digging into it:
π https://specterops.io/blog/2025/08/19/will-webclient-start/
π₯ [ tweet ]
I wanted to find out if you could start the WebClient service remotely, so I ended up digging into it:
π https://specterops.io/blog/2025/08/19/will-webclient-start/
π₯ [ tweet ]
π₯7
π [ Daniel @0x64616e ]
I stumbled upon this tweet and dug a bit deeper into the internals of ksetup.exe:
π https://pentest.party/posts/2025/ksetup-machine-password/
When you are local admin and need machine account credentials this could be a viable alternative to the good old LSA dump.
π₯ [ tweet ][ quote ]
I stumbled upon this tweet and dug a bit deeper into the internals of ksetup.exe:
π https://pentest.party/posts/2025/ksetup-machine-password/
When you are local admin and need machine account credentials this could be a viable alternative to the good old LSA dump.
π₯ [ tweet ][ quote ]
π₯7
π [ Two Seven One Three @TwoSevenOneT ]
"clipup.exe" in System32 is very powerful. It can destroy the executable file of the EDR service π Experimenting with overwriting the MsMpEng.exe file.
Proactively creating processes with Protected Process Light (PPL) protection will give you more opportunities to abuse these processes. Detailed article:
π https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html
π₯ [ tweet ]
"clipup.exe" in System32 is very powerful. It can destroy the executable file of the EDR service π Experimenting with overwriting the MsMpEng.exe file.
Proactively creating processes with Protected Process Light (PPL) protection will give you more opportunities to abuse these processes. Detailed article:
π https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html
π₯ [ tweet ]
π₯12π1
π [ spencer @techspence ]
A quick and easy way to find services with unquoted service paths is to open up PowerShell and run the following:
π₯ [ tweet ]
A quick and easy way to find services with unquoted service paths is to open up PowerShell and run the following:
Get-WmiObject win32_service | select Name,PathName,StartMode,StartName | where {$_.StartMode -ne "Disabled" -and $_.StartName -eq "LocalSystem" -and $_.PathNameπ₯ [ tweet ]
π21π7
π [ SpecterOps @SpecterOps ]
Cookie theft has evolved πͺ
Over the last year, stealing cookies on Windows devices has changed significantly for Chromium browsers like Chrome and Edge. Andrew Gomez dives into these changes, how threat actors adapt, & new detection opportunities.
π https://specterops.io/blog/2025/08/27/dough-no-revisiting-cookie-theft/
π₯ [ tweet ]
Cookie theft has evolved πͺ
Over the last year, stealing cookies on Windows devices has changed significantly for Chromium browsers like Chrome and Edge. Andrew Gomez dives into these changes, how threat actors adapt, & new detection opportunities.
π https://specterops.io/blog/2025/08/27/dough-no-revisiting-cookie-theft/
π₯ [ tweet ]
π₯11
π [ Yuval Gordon @YuG0rd ]
BadSuccessor is dead⦠or is it?
The patch for CVE-2025-53779 fixed the priv-esc. While no longer a vulnerability, the tactic still applies in certain scenarios.
Defenders should be aware of it.
Details:
π https://www.akamai.com/blog/security-research/badsuccessor-is-dead-analyzing-badsuccessor-patch
π₯ [ tweet ]
BadSuccessor is dead⦠or is it?
The patch for CVE-2025-53779 fixed the priv-esc. While no longer a vulnerability, the tactic still applies in certain scenarios.
Defenders should be aware of it.
Details:
π https://www.akamai.com/blog/security-research/badsuccessor-is-dead-analyzing-badsuccessor-patch
π₯ [ tweet ]
π2π₯2
This media is not supported in your browser
VIEW IN TELEGRAM
π [ Tijme Gommers @tijme ]
Exciting times. I'm publishing Dittobytes today after presenting it at @OrangeCon_nl !
Dittobytes is a true metamorphic cross-compiler aimed at evasion. Use Dittobytes to compile your malware. Each compilation produces unique, functional shellcode.
π https://github.com/tijme/dittobytes
π₯ [ tweet ]
Exciting times. I'm publishing Dittobytes today after presenting it at @OrangeCon_nl !
Dittobytes is a true metamorphic cross-compiler aimed at evasion. Use Dittobytes to compile your malware. Each compilation produces unique, functional shellcode.
π https://github.com/tijme/dittobytes
π₯ [ tweet ]
π₯14π3
π [ Kurosh Dabbagh @_Kudaes_ ]
I just released MFTool, an NTFS parser that builds an in-memory map of a volume, allowing you to:
- Read any file without opening a handle
- Get the contents of locked/deleted files (registry hives, pagefile.sys, etc)
- Perform fast, in-memory searches across the entire disk
Although direct access to disk is not new at all, especially when it comes to forensics, I think this approach could be useful in a number of contexts during a RT engagement.
π https://github.com/Kudaes/MFTool
π₯ [ tweet ]
I just released MFTool, an NTFS parser that builds an in-memory map of a volume, allowing you to:
- Read any file without opening a handle
- Get the contents of locked/deleted files (registry hives, pagefile.sys, etc)
- Perform fast, in-memory searches across the entire disk
Although direct access to disk is not new at all, especially when it comes to forensics, I think this approach could be useful in a number of contexts during a RT engagement.
π https://github.com/Kudaes/MFTool
π₯ [ tweet ]
π₯13π2
π [ Unit 42 @Unit42_Intel ]
We discuss an uptick in use of the relatively unknown AdaptixC2, an open-source C2 framework, by attackers. Our research details its functionality, configuration as well as observed deployment techniques, including novel AI-assisted methods.
π https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/
π₯ [ tweet ]
We discuss an uptick in use of the relatively unknown AdaptixC2, an open-source C2 framework, by attackers. Our research details its functionality, configuration as well as observed deployment techniques, including novel AI-assisted methods.
π https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/
π₯ [ tweet ]
π₯9π3
π [ @zephrfish.yxz.red @ZephrFish ]
Made a thing, mucking about with python and a LDAP browser concept to ingest straight into BloodHound, simple LDAP browser using PyQt as a GUI and neo4j-driver to ingest into BH.
π https://github.com/ZephrFish/pyLDAPGui
π₯ [ tweet ]
Made a thing, mucking about with python and a LDAP browser concept to ingest straight into BloodHound, simple LDAP browser using PyQt as a GUI and neo4j-driver to ingest into BH.
π https://github.com/ZephrFish/pyLDAPGui
π₯ [ tweet ]
π11