😈 [ theluemmel, S4U2LuemmelSec ]
Oh holy Nimikätz / custom invoke-mimikatz
If you want the l33t shit for your next engagement you should:
Read -> https://t.co/ZCP5OP1M9e
Read -> https://t.co/8ulbUEyZJY
Use -> https://t.co/WNRJrDGGIz from @danielhbohannon
Use -> private tools from @ShitSecure by sponsoring him
🔗 https://s3cur3th1ssh1t.github.io/Bypass-AMSI-by-manual-modification-part-II/
🔗 https://s3cur3th1ssh1t.github.io/Building-a-custom-Mimikatz-binary/
🔗 https://github.com/danielbohannon/Invoke-Obfuscation
🐥 [ tweet ]
Oh holy Nimikätz / custom invoke-mimikatz
If you want the l33t shit for your next engagement you should:
Read -> https://t.co/ZCP5OP1M9e
Read -> https://t.co/8ulbUEyZJY
Use -> https://t.co/WNRJrDGGIz from @danielhbohannon
Use -> private tools from @ShitSecure by sponsoring him
🔗 https://s3cur3th1ssh1t.github.io/Bypass-AMSI-by-manual-modification-part-II/
🔗 https://s3cur3th1ssh1t.github.io/Building-a-custom-Mimikatz-binary/
🔗 https://github.com/danielbohannon/Invoke-Obfuscation
🐥 [ tweet ]
😈 [ mcohmi, Ohm-I (Oh My) ]
New tool drop. Introducing Dumpscan, a wrapper around volatility3 and some other stuff to make dumping certificates way easier. You can read about it here.
https://t.co/CAK4Y2QSJm
🔗 https://daddycocoaman.dev/posts/introducing-dumpscan/
🔗 https://github.com/daddycocoaman/dumpscan
🐥 [ tweet ]
New tool drop. Introducing Dumpscan, a wrapper around volatility3 and some other stuff to make dumping certificates way easier. You can read about it here.
https://t.co/CAK4Y2QSJm
🔗 https://daddycocoaman.dev/posts/introducing-dumpscan/
🔗 https://github.com/daddycocoaman/dumpscan
🐥 [ tweet ]
😈 [ bmcder02, Blake ]
Recently I got asked to do an overview on ETW. I tried to cover everything useful for #DFIR, including multiple ways to capture ETW, useful providers and finding existing trace sessions.
#cybersecurity
https://t.co/3IWn9w6JuQ
🔗 http://bmcder.com/blog/a-begginers-all-inclusive-guide-to-etw
🐥 [ tweet ]
Recently I got asked to do an overview on ETW. I tried to cover everything useful for #DFIR, including multiple ways to capture ETW, useful providers and finding existing trace sessions.
#cybersecurity
https://t.co/3IWn9w6JuQ
🔗 http://bmcder.com/blog/a-begginers-all-inclusive-guide-to-etw
🐥 [ tweet ]
😈 [ DirectoryRanger, DirectoryRanger ]
Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction #DFIR
https://t.co/8BZPvX83Ij
🔗 https://jeffreyappel.nl/detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction/
🐥 [ tweet ]
Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction #DFIR
https://t.co/8BZPvX83Ij
🔗 https://jeffreyappel.nl/detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction/
🐥 [ tweet ]
😈 [ DirectoryRanger, DirectoryRanger ]
Scheduled Task Tampering
https://t.co/eJvDt166kV
🔗 https://labs.f-secure.com/blog/scheduled-task-tampering/
🐥 [ tweet ]
Scheduled Task Tampering
https://t.co/eJvDt166kV
🔗 https://labs.f-secure.com/blog/scheduled-task-tampering/
🐥 [ tweet ]
😈 [ daem0nc0re, daem0nc0re ]
Added a small PoC to PrivilegedOperations project.
This PoC is to test SeShutdownPrivilege and tries to cause BSOD.
https://t.co/TYcXE9wUte
🔗 https://github.com/daem0nc0re/PrivFu/blob/main/PrivilegedOperations/SeShutdownPrivilegePoC/SeShutdownPrivilegePoC.cs
🐥 [ tweet ]
Added a small PoC to PrivilegedOperations project.
This PoC is to test SeShutdownPrivilege and tries to cause BSOD.
https://t.co/TYcXE9wUte
🔗 https://github.com/daem0nc0re/PrivFu/blob/main/PrivilegedOperations/SeShutdownPrivilegePoC/SeShutdownPrivilegePoC.cs
🐥 [ tweet ]
😈 [ ntlmrelay, Ring3API ]
📌Dismember tool by @liam_galvin - scan memory for secrets and more.
⚙️https://t.co/3anDqypiVb
#redteam #BlueTeam #threathunting #DFIR
🔗 https://github.com/liamg/dismember
🐥 [ tweet ]
📌Dismember tool by @liam_galvin - scan memory for secrets and more.
⚙️https://t.co/3anDqypiVb
#redteam #BlueTeam #threathunting #DFIR
🔗 https://github.com/liamg/dismember
🐥 [ tweet ]
😈 [ DirectoryRanger, DirectoryRanger ]
A Syscall Journey in the Windows Kernel, by @AliceCliment
https://t.co/xlGizX3pEm
🔗 https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/
🐥 [ tweet ]
A Syscall Journey in the Windows Kernel, by @AliceCliment
https://t.co/xlGizX3pEm
🔗 https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/
🐥 [ tweet ]
😈 [ tiraniddo, James Forshaw ]
After @clearbluejar's post of using NtObjectManager for RPC I thought I should finish a post about how a few approaches to narrow down the enumeration to individual running processes rather than having to parse all executables on disk. https://t.co/xh22G6Ek80
🔗 https://www.tiraniddo.dev/2022/06/finding-running-rpc-server-information.html
🐥 [ tweet ]
After @clearbluejar's post of using NtObjectManager for RPC I thought I should finish a post about how a few approaches to narrow down the enumeration to individual running processes rather than having to parse all executables on disk. https://t.co/xh22G6Ek80
🔗 https://www.tiraniddo.dev/2022/06/finding-running-rpc-server-information.html
🐥 [ tweet ]
😈 [ ORCA10K, ORCA ]
after hiding the payload in the thread description, i decided to search for new places for the same purpose, so im releasing a new poc, that hide your payload in nvidia's gpu memory.
https://t.co/06mPPffWIt
🔗 https://gitlab.com/ORCA000/gp
🐥 [ tweet ]
after hiding the payload in the thread description, i decided to search for new places for the same purpose, so im releasing a new poc, that hide your payload in nvidia's gpu memory.
https://t.co/06mPPffWIt
🔗 https://gitlab.com/ORCA000/gp
🐥 [ tweet ]
😈 [ n00py1, n00py ]
Do you use AADInternals Invoke-AADIntReconAsOutsider by @DrAzureAD? Surer useful when finding related domains when doing an External Penetration Test.
https://t.co/mWGz0YqhDK
🔗 https://o365blog.com/aadinternals/#invoke-aadintreconasoutsider
🐥 [ tweet ]
Do you use AADInternals Invoke-AADIntReconAsOutsider by @DrAzureAD? Surer useful when finding related domains when doing an External Penetration Test.
https://t.co/mWGz0YqhDK
🔗 https://o365blog.com/aadinternals/#invoke-aadintreconasoutsider
🐥 [ tweet ]
😈 [ S0ufi4n3, Soufiane Tahiri ]
Here is the code of my #Ransomware simulator: https://t.co/iOlPkPL0xx
I ended up replacing AES with simple XOR.
- Exfiltrating Documents (SMTP and/or FTP)
- Creating/Deleting Volume Shadow Copies
- Encrypting documents
- Dropping a ransomware note to the user's desktop
🔗 https://github.com/soufianetahiri/RansomwareSimulator.public
🐥 [ tweet ]
Here is the code of my #Ransomware simulator: https://t.co/iOlPkPL0xx
I ended up replacing AES with simple XOR.
- Exfiltrating Documents (SMTP and/or FTP)
- Creating/Deleting Volume Shadow Copies
- Encrypting documents
- Dropping a ransomware note to the user's desktop
🔗 https://github.com/soufianetahiri/RansomwareSimulator.public
🐥 [ tweet ]
😈 [ bitsadmin, Arris Huijgen ]
New blog post on my experiences with importing and querying large #BloodHound datasets using Neo4j's Cypher query language: https://t.co/Gux8V1ZJSJ. Utilities for importing large dumps available at https://t.co/n7yrzoIDDO.
🔗 https://blog.bitsadmin.com/blog/dealing-with-large-bloodhound-datasets
🔗 https://github.com/bitsadmin/chophound
🐥 [ tweet ]
New blog post on my experiences with importing and querying large #BloodHound datasets using Neo4j's Cypher query language: https://t.co/Gux8V1ZJSJ. Utilities for importing large dumps available at https://t.co/n7yrzoIDDO.
🔗 https://blog.bitsadmin.com/blog/dealing-with-large-bloodhound-datasets
🔗 https://github.com/bitsadmin/chophound
🐥 [ tweet ]
😈 [ n00py1, n00py ]
LAPSDumper can now export to CSV. Thanks to @NaisuBanana
https://t.co/sc0YJk5ITX
🔗 https://github.com/n00py/LAPSDumper/pull/5
🐥 [ tweet ]
LAPSDumper can now export to CSV. Thanks to @NaisuBanana
https://t.co/sc0YJk5ITX
🔗 https://github.com/n00py/LAPSDumper/pull/5
🐥 [ tweet ]
😈 [ daem0nc0re, daem0nc0re ]
Released a PoC for SeTrustedCredmanAccessPrivilege.
This PoC tries to get decrypted DPAPI blob for user account who execute it.
As far as I tested, it seems that SYSTEM integrity level is required to use this privilege.
https://t.co/XivEJdZS4Y
🔗 https://github.com/daem0nc0re/PrivFu#privilegedoperations
🐥 [ tweet ]
Released a PoC for SeTrustedCredmanAccessPrivilege.
This PoC tries to get decrypted DPAPI blob for user account who execute it.
As far as I tested, it seems that SYSTEM integrity level is required to use this privilege.
https://t.co/XivEJdZS4Y
🔗 https://github.com/daem0nc0re/PrivFu#privilegedoperations
🐥 [ tweet ]
😈 [ codewhitesec, Code White GmbH ]
Bypassing .NET Serialization Binders: case studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277) by @mwulftange https://t.co/G90Qg7gQ9m
🔗 https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html
🐥 [ tweet ]
Bypassing .NET Serialization Binders: case studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277) by @mwulftange https://t.co/G90Qg7gQ9m
🔗 https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html
🐥 [ tweet ]