TiEtwAgent - PoC Memory Injection Detection Agent Based On ETW, For Offensive And Defensive Research Purposes
http://www.kitploit.com/2021/07/tietwagent-poc-memory-injection.html

This project was created to research, build and test different memory (https://www.kitploit.com/search/label/Memory) injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing (https://www.kitploit.com/search/label/Tracing) provider, as a more modern and stable alternative to Userland-hooking, with the benefit of Kernel-mode visibility. The project depends on the microsoft/krabsetw (https://github.com/microsoft/krabsetw) library (https://www.kitploit.com/search/label/Library) for ETS setup and consumption. An accompanying blog post can be found here: https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection
Adding new detections
Detection functions can be easily added in DetectionLogic.cpp, and called from detect_event(GenericEvent evt) for any source event type. Support for new event fields can be easily added by appending their name to the map in GenericEvent class declaration.
Setup instructions
Assuming you do not have a Microsoft-trusted signing certificate: Put your machine in the test signing mode with bcdedit Generate a self-signed certificate with ELAM and Code Signing EKU Sign TiEtwAgent.exe and your ELAM driver with the certificate ./TiEtwAgent install net start TiEtwAgent Look for logs, by default in C:\Windows\Temp\TiEtwAgent.txt
TODO
PPL Service, event parsing First detection Detection lifecycle Risk based lifecycle PS. If you do not want to write an ELAM driver, you can get one from https://github.com/pathtofile/PPLRunner/tree/main/elam_driver Special thanks to @pathtofile (https://github.com/pathtofile) for the post here: https://blog.tofile.dev/2020/12/16/elam.html

Download TiEtwAgent (https://github.com/xinbailu/TiEtwAgent)

hacking: security in practice
is there a way to find a working sni for free-riding ?

for my isp like zerofacebook/internet.org and others that unfortunately most of them are not listed . but non of them can be used as a bug host anymore (or at least as far as I know because idk all of them) all there is left is some zero-rated websites with open ports, and howdy.id doesn't have any and for my country's isp's in there
any help to find one? because any HTTP injector or v2ray or proxy etc are useless without it

submitted by /u/Nziom
[link] [comments]

hacking: security in practice
Hey guys. I know there are many reddit communitys about stocks and here you go I made another one.👏😁

It is actually like hacking: looking for vulnerabilities and attack it with many people/ computers to cause some serious damage.

DIFFERENCE is: 1. everything will be organized 2. focus on one or two stocks 3. decisions about stocks by surveys (not everyone can post stuff)

-these three things will cause more power to the community 💥

You are welcome!

https://www.reddit.com/r/Stockexploder/

submitted by /u/stockexploder
[link] [comments]

TiEtwAgent - PoC Memory Injection Detection Agent Based On ETW, For Offensive And Defensive Research Purposes

This project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to Userland-hooking, with the benefit of Kernel-mode visibility. The project depends on the microsoft/krabsetw library for ETS setup and consumption. An accompanying blog post can be found here: https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detectionAdding new detections Detection functions can be easily added in DetectionLogic.cpp, and called from detect_event(GenericEvent evt) for any source event type. Support for new event fields can be easily added by appending their name to the map in GenericEvent class declaration. Setup instructions Assuming you do not have a Microsoft-trusted signing certificate: Put your machine in the test signing mode with bcdedit Generate a self-signed certificate with ELAM and Code Signing EKU Sign TiEtwAgent.exe and your ELAM driver with the certificate ./TiEtwAgent install net start TiEtwAgent Look for logs, by default in C:\Windows\Temp\TiEtwAgent.txt TODO PPL Service, event parsing First detection Detection lifecycle Risk based lifecycle PS. If you do not want to write an ELAM driver, you can get one from https://github.com/pathtofile/PPLRunner/tree/main/elam_driver Special thanks to @pathtofile for the post here: https://blog.tofile.dev/2020/12/16/elam.html Download TiEtwAgent
Read more...

Dark Reading: Attacks/Breaches
8 Ways to Preserve Legal Privilege After a Cybersecurity Incident

Knowing your legal distinctions can make defense easier should you end up in court after a breach, attack, or data loss.

Dark Reading: Attacks/Breaches
Cyberattack on Kaseya Nets More Than 1,000 Victims, $70M Ransom Demand

The provider of remote monitoring and management services warns customers to not run its software until a patch is available and manually installed.

Kali Linux Tutorials
Fully-Homomorphic-Encryption : Libraries And Tools To Perform Fully Homomorphic Encryption Operations On An Encrypted Data Set

Fully-Homomorphic-Encryption, this repository contains open-source libraries and tools to perform fully homomorphic encryption (FHE) operations on an encrypted data set. About Fully Homomorphic Encryption Fully Homomorphic Encryption (FHE) is an emerging data processing paradigm that allows developers to perform transformations on encrypted data. FHE can change the way computations are performed by preserving privacy end-to-end, […]

The post Fully-Homomorphic-Encryption : Libraries And Tools To Perform Fully Homomorphic Encryption Operations On An Encrypted Data Set appeared first on Kali Linux Tutorials.

Kali Linux Tutorials
Heappy : A Happy Heap Editor To Support Your Exploitation Process

Heappy is an editor based on gdb/gef that helps you to handle the heap during your exploitation development.The project should be considered a didactic tool useful to understand the evolution of the heap during the process life cycle. It has been created to simplify the study of the most common heap exploitation techniques and to […]

The post Heappy : A Happy Heap Editor To Support Your Exploitation Process appeared first on Kali Linux Tutorials.

KitPloit - PenTest Tools!
TiEtwAgent - PoC Memory Injection Detection Agent Based On ETW, For Offensive And Defensive Research Purposes

http://3.bp.blogspot.com/-ys4m_fjKPsk/YNj1S5YhgdI/AAAAAAAAeMc/zfaBKl-lB-cmEFmG1ljpd2A1z5Cw5k2oACK4BGAYYCw/w640-h360/TiEtwAgent_2-701354.gif
This project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to Userland-hooking, with the benefit of Kernel-mode visibility.

The project depends on the microsoft/krabsetw library for ETS setup and consumption.

An accompanying blog post can be found here: https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection
Adding new detections

Detection functions can be easily added in DetectionLogic.cpp, and called from detect_event(GenericEvent evt)for any source event type. Support for new event fields can be easily added by appending their name to the map in GenericEventclass declaration.

Setup instructions

Assuming you do not have a Microsoft-trusted signing certificate:

* Put your machine in the test signing mode with bcdedit
* Generate a self-signed certificate with ELAM and Code Signing EKU
* Sign TiEtwAgent.exe and your ELAM driver with the certificate
* ./TiEtwAgent install
* net start TiEtwAgent
* Look for logs, by default in C:\Windows\Temp\TiEtwAgent.txt

TODO

* PPL Service, event parsing
* First detection
* Detection lifecycle
* Risk based lifecycle

PS. If you do not want to write an ELAM driver, you can get one from https://github.com/pathtofile/PPLRunner/tree/main/elam_driver

Special thanks to @pathtofile for the post here: https://blog.tofile.dev/2020/12/16/elam.html
Download TiEtwAgent

Hacking on Medium
WANNA GET STARTED WITH CYBERSECURITY BUT DON’T KNOW WHERE TO BEGIN?

https://cdn-images-1.medium.com/max/1320/1*FkiDfjBBKw1Wq3x3YLyVPw.png
Like always, I was checking around the Try Hack Me website for my daily dose and came across a new room PRE SECURITY, which was completely…

Continue reading on Medium »

Hacking on Medium
Insane Path That Will Grant You All Beginner Hacking Skills - Tryhackme’s Pre-Security Path

https://cdn-images-1.medium.com/max/1920/1*eQAhbli_ZiCtY1vGSHIc2w.png
“What is the easy path to hacking ?”

Continue reading on Medium »

Hacking on Medium
Start hacking today with TryHackMe

https://cdn-images-1.medium.com/max/1122/1*bVklSxvgVeHpVcQmI1dnuA.png
Hello, today I would like to share with you guys this website tryhackme.com. I am relatively new to hacking being only a second-year…

Continue reading on Medium »