Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
SigFlip : A Tool For Patching Authenticode Signed PE Files
SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) in a way that doesn’t affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data (i.e shellcode) without breaking the file signature, integrity checks or PE file functionality.
SigInject encrypts and injects shellcode into a PE file’s [WIN_CERTIFICATE] certificate table, the encryption key is printed out for usage with a basic BOF/C/C# loader (SigLoader), SigInject saves changes to a modified PE file and keeps its signature and certificate validity intact.
SigLoader is a basic loader which takes a modified PE file path created by SigInject and the decryption key as parameters, then extract and decrypt embedded shellcode for usage with a shellcode injection of choice.
SigFlip will check if PE hash was successfully changed and also check and exit gracefully in case endpoints are hardened against such common misconfiguration. (check “Details” section).
Quick Note: SigFlip, SigInject and SigLoader are available as BOF scripts and .NET assemblies, the only difference is that SigInject functionality is implemented as part of SigFlip (-i) in case if you choose to use .NET artifacts instead of BOFs.
Why ?
It can be used mainly for persistence, lateral movement or code/command execution and can help with:
* Application whitelisting bypasses, changing the PE file hash (msbuild.exe for ex) without breaking the signature.
* Bypassing EDRs relying on specific LOLBINs’ hashes for malicious code/command execution detection.
* Load signed drivers using a different hash, might help circumvent any EDRs watching for common vulnerable signed drivers using a pre-defined list of hashes.
* Embed encrypted shellcode in a signed PE file and use a stager (sigloader) of your preference to parse, decrypt, load and execute it.
* Endpoint security vendors tend to classify signed PE files as benign most of the time, embedding your unsigned code (shellcode ..etc.) in a signed PE file makes it a little bit hard to detect/flag.
* Bypassing endpoint security vendors relying mainly on the default WinVerifyTrust for signature validation.
* Improving OPSEC and challenging defenders relying solely on typical signature verification utilities such as signtool, sigcheck, Get-AuthenticodeSignature ..etc to validate the authenticoode signature of PE files.
Usage & Examples
Compile/Build
Precompiled BOF’s are not provided in this project, can be compiled using Mingw-w64, for .NET use VS or csc.exe to compile .NET projects (SigFlip, SigLoader), for BOF check steps below;
*
*
*
*
Make sure all object files are located in the same directory as sigflip.cna, then load sigflip.cna script to cobalt strike.
Quick Note: pre-compiled BOFs were test[...]
SigFlip : A Tool For Patching Authenticode Signed PE Files
SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) in a way that doesn’t affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data (i.e shellcode) without breaking the file signature, integrity checks or PE file functionality.
SigInject encrypts and injects shellcode into a PE file’s [WIN_CERTIFICATE] certificate table, the encryption key is printed out for usage with a basic BOF/C/C# loader (SigLoader), SigInject saves changes to a modified PE file and keeps its signature and certificate validity intact.
SigLoader is a basic loader which takes a modified PE file path created by SigInject and the decryption key as parameters, then extract and decrypt embedded shellcode for usage with a shellcode injection of choice.
SigFlip will check if PE hash was successfully changed and also check and exit gracefully in case endpoints are hardened against such common misconfiguration. (check “Details” section).
Quick Note: SigFlip, SigInject and SigLoader are available as BOF scripts and .NET assemblies, the only difference is that SigInject functionality is implemented as part of SigFlip (-i) in case if you choose to use .NET artifacts instead of BOFs.
Why ?
It can be used mainly for persistence, lateral movement or code/command execution and can help with:
* Application whitelisting bypasses, changing the PE file hash (msbuild.exe for ex) without breaking the signature.
* Bypassing EDRs relying on specific LOLBINs’ hashes for malicious code/command execution detection.
* Load signed drivers using a different hash, might help circumvent any EDRs watching for common vulnerable signed drivers using a pre-defined list of hashes.
* Embed encrypted shellcode in a signed PE file and use a stager (sigloader) of your preference to parse, decrypt, load and execute it.
* Endpoint security vendors tend to classify signed PE files as benign most of the time, embedding your unsigned code (shellcode ..etc.) in a signed PE file makes it a little bit hard to detect/flag.
* Bypassing endpoint security vendors relying mainly on the default WinVerifyTrust for signature validation.
* Improving OPSEC and challenging defenders relying solely on typical signature verification utilities such as signtool, sigcheck, Get-AuthenticodeSignature ..etc to validate the authenticoode signature of PE files.
Usage & Examples
Compile/Build
Precompiled BOF’s are not provided in this project, can be compiled using Mingw-w64, for .NET use VS or csc.exe to compile .NET projects (SigFlip, SigLoader), for BOF check steps below;
*
➜ i686-w64-mingw32-gcc -c sigflip.c -o sigflip.x86.o*
➜ x86_64-w64-mingw32-gcc -c sigflip.c -o sigflip.x64.o*
➜ x86_64-w64-mingw32-gcc -c SigLoader/sigloader.c -o sigloader.x64.o*
➜ i686-w64-mingw32-gcc -c SigLoader/sigloader.c -o sigloader.x86.oMake sure all object files are located in the same directory as sigflip.cna, then load sigflip.cna script to cobalt strike.
Quick Note: pre-compiled BOFs were test[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials403Bypasser : Automates The Techniques Used To Circumvent Access Control Restrictions On Target Pages
403bypasser automates the techniques used to circumvent access control restrictions on target pages. 403bypasser will continue to be improved and it is open to contributions.
Installation
* Clone the repository to your machine.
* Install required modules by running the code
* READY!
Usage
Arguments
ArgumentDescriptionExamplesNote-usingle URL to scanhttp://example.com or http://example.com/All these example usages are interpreted in the same way-Upath to list of URLs./urllist.txt, ../../urllist.txt, etc.Just provide the path where the file is located -dsingle directory to scanadmin or /admin or admin/ or /admin/All these example usages are interpreted in the same way-Dpath to list of directories./dirlist.txt, ../../dirlist.txt, etc.Just provide the path where the file is located
Usage 1:
Usage 2:
Usage 3:
Usage 4:
IMPORTANT NOTE: All the followings are interpreted the same. Therefore, which pattern you use is just a matter of preference.
*
*
*
*
*
ALL THE SAME!
Since Python is a cross-platform language, one can run this program on different operating systems.
Output
The output of the program is saved (in the current directory) in a file with the name of the domain name given as input.
For example:
Download
403bypasser automates the techniques used to circumvent access control restrictions on target pages. 403bypasser will continue to be improved and it is open to contributions.
Installation
* Clone the repository to your machine.
git clone https://github.com/yunemse48/403bypasser.git* Install required modules by running the code
pip install -r requirements.txt* READY!
Usage
Arguments
ArgumentDescriptionExamplesNote-usingle URL to scanhttp://example.com or http://example.com/All these example usages are interpreted in the same way-Upath to list of URLs./urllist.txt, ../../urllist.txt, etc.Just provide the path where the file is located -dsingle directory to scanadmin or /admin or admin/ or /admin/All these example usages are interpreted in the same way-Dpath to list of directories./dirlist.txt, ../../dirlist.txt, etc.Just provide the path where the file is located
Usage 1:
python3 403bypasser.py -u https://example.com -d /secretUsage 2:
python3 403bypasser.py -u https://example.com -D dirlist.txtUsage 3:
python3 403bypasser.py -U urllist.txt -d /secretUsage 4:
python3 403bypasser.py -U urllist.txt -D dirlist.txtIMPORTANT NOTE: All the followings are interpreted the same. Therefore, which pattern you use is just a matter of preference.
*
python3 403bypasser.py -u https://example.com -d secret*
python3 403bypasser.py -u https://example.com -d /secret*
python3 403bypasser.py -u https://example.com -d /secret/*
python3 403bypasser.py -u https://example.com -d secret/*
python3 403bypasser.py -u https://example.com/ -d secretALL THE SAME!
Since Python is a cross-platform language, one can run this program on different operating systems.
Output
The output of the program is saved (in the current directory) in a file with the name of the domain name given as input.
For example:
python3 403bypasser.py -u https://example.com -d /secret is given. Then the output is saved to example.txt in the current directory.Download
Does red team exercises need to follow change control?
https://www.reddit.com/r/redteamsec/comments/pr48nr/does_red_team_exercises_need_to_follow_change/
<!-- SC_OFF -->According to Penetration Testing For Dummies (https://www.wiley.com/en-my/Penetration+Testing+For+Dummies-p-9781119577485) book chapter 9, page 121; You will likely need to do a change control to document the fact that a change (scanning, testing, and attempting of changes on your network and systems) will be taking place. Change control is necessary to document what is happening but also to log the time, date, and other useful information needed if an incident arises from the scan itself and support teams need to mobilize to assist. A critical prep item should be a contingency plan if something goes wrong. Is similar control required for red team exercises? The reason I'm asking this is because: Penetration tests are not focused on stealth, evasion, or the ability of the blue team to detect and respond, since the blue team is fully aware of the scope of the testing being conducted. while Red teaming projects differ in that they are heavily focused on emulating an advanced threat actor (https://www.ibm.com/security/solutions/detect-advanced-persistent-threats/) using stealth, subverting established defensive controls and identifying gaps in the organization’s defensive strategy. Reference: https://securityintelligence.com/posts/penetration-testing-versus-red-teaming-clearing-the-confusion/ If a change ticket is submitted for red team exercises, won't it defeat the purpose to be stealth as blue team would be able to check the ticket number, and to find more details about the exercises such as exact date and time? What is the common/right process for this? <!-- SC_ON --> submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/redteamsec/comments/pr48nr/does_red_team_exercises_need_to_follow_change/) [comments] (https://www.reddit.com/r/redteamsec/comments/pr48nr/does_red_team_exercises_need_to_follow_change/)
https://www.reddit.com/r/redteamsec/comments/pr48nr/does_red_team_exercises_need_to_follow_change/
<!-- SC_OFF -->According to Penetration Testing For Dummies (https://www.wiley.com/en-my/Penetration+Testing+For+Dummies-p-9781119577485) book chapter 9, page 121; You will likely need to do a change control to document the fact that a change (scanning, testing, and attempting of changes on your network and systems) will be taking place. Change control is necessary to document what is happening but also to log the time, date, and other useful information needed if an incident arises from the scan itself and support teams need to mobilize to assist. A critical prep item should be a contingency plan if something goes wrong. Is similar control required for red team exercises? The reason I'm asking this is because: Penetration tests are not focused on stealth, evasion, or the ability of the blue team to detect and respond, since the blue team is fully aware of the scope of the testing being conducted. while Red teaming projects differ in that they are heavily focused on emulating an advanced threat actor (https://www.ibm.com/security/solutions/detect-advanced-persistent-threats/) using stealth, subverting established defensive controls and identifying gaps in the organization’s defensive strategy. Reference: https://securityintelligence.com/posts/penetration-testing-versus-red-teaming-clearing-the-confusion/ If a change ticket is submitted for red team exercises, won't it defeat the purpose to be stealth as blue team would be able to check the ticket number, and to find more details about the exercises such as exact date and time? What is the common/right process for this? <!-- SC_ON --> submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/redteamsec/comments/pr48nr/does_red_team_exercises_need_to_follow_change/) [comments] (https://www.reddit.com/r/redteamsec/comments/pr48nr/does_red_team_exercises_need_to_follow_change/)
hacking: security in practice
RFID signal copying?
I am starting to go to an art exhibit that uses RFID cards to track your progress and I would like to make a custom version for myself. I just want to copy the same Signal that’s already on the exhibit card and put it on a cosmetically customized rfid tag.
I also need to know what tags would be able to Interface with the specs below.
Tag type: iso 15693
Technologies available: Type V
Memory information: 320 bytes, 80 blocks (4 bytes each)
submitted by /u/Le_Mo_Fo_Jones
[link] [comments]
RFID signal copying?
I am starting to go to an art exhibit that uses RFID cards to track your progress and I would like to make a custom version for myself. I just want to copy the same Signal that’s already on the exhibit card and put it on a cosmetically customized rfid tag.
I also need to know what tags would be able to Interface with the specs below.
Tag type: iso 15693
Technologies available: Type V
Memory information: 320 bytes, 80 blocks (4 bytes each)
submitted by /u/Le_Mo_Fo_Jones
[link] [comments]
reddit
RFID signal copying?
I am starting to go to an art exhibit that uses RFID cards to track your progress and I would like to make a custom version for myself. I just...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Change control in red team exercises
According to Penetration Testing For Dummies book chapter 9, page 121;
You will likely need to do a change control to document the fact that a change (scanning, testing, and attempting of changes on your network and systems) will be taking place.
Change control is necessary to document what is happening but also to log the time, date, and other useful information needed if an incident arises from the scan itself and support teams need to mobilize to assist. A critical prep item should be a contingency plan if something goes wrong.
Is similar control required for red team exercises?
The reason I'm asking this is because:
Penetration tests are not focused on stealth, evasion, or the ability of the blue team to detect and respond, since the blue team is fully aware of the scope of the testing being conducted.
while
Red teaming projects differ in that they are heavily focused on emulating an advanced threat actor using stealth, subverting established defensive controls and identifying gaps in the organization’s defensive strategy.
Reference: https://securityintelligence.com/posts/penetration-testing-versus-red-teaming-clearing-the-confusion/
If a change ticket is submitted for red team exercises, won't it defeat the purpose to be stealth as blue team would be able to check the ticket number, and to find more details about the exercises such as exact date and time?
What is the common/right process for this?
submitted by /u/w0lfcat
[link] [comments]
Change control in red team exercises
According to Penetration Testing For Dummies book chapter 9, page 121;
You will likely need to do a change control to document the fact that a change (scanning, testing, and attempting of changes on your network and systems) will be taking place.
Change control is necessary to document what is happening but also to log the time, date, and other useful information needed if an incident arises from the scan itself and support teams need to mobilize to assist. A critical prep item should be a contingency plan if something goes wrong.
Is similar control required for red team exercises?
The reason I'm asking this is because:
Penetration tests are not focused on stealth, evasion, or the ability of the blue team to detect and respond, since the blue team is fully aware of the scope of the testing being conducted.
while
Red teaming projects differ in that they are heavily focused on emulating an advanced threat actor using stealth, subverting established defensive controls and identifying gaps in the organization’s defensive strategy.
Reference: https://securityintelligence.com/posts/penetration-testing-versus-red-teaming-clearing-the-confusion/
If a change ticket is submitted for red team exercises, won't it defeat the purpose to be stealth as blue team would be able to check the ticket number, and to find more details about the exercises such as exact date and time?
What is the common/right process for this?
submitted by /u/w0lfcat
[link] [comments]
hacking: security in practice
Hello!
Thanks for reading my post, Someone hacked my snapchat account and changed the linked email,phone number and password. I tried emailing support snapchat, but their inbox is under maintenance rn. How do I get my account back?
submitted by /u/Zermilion
[link] [comments]
Hello!
Thanks for reading my post, Someone hacked my snapchat account and changed the linked email,phone number and password. I tried emailing support snapchat, but their inbox is under maintenance rn. How do I get my account back?
submitted by /u/Zermilion
[link] [comments]
reddit
Hello!
Thanks for reading my post, Someone hacked my snapchat account and changed the linked email,phone number and password. I tried emailing support...
Hello to all the cyber security enthusiasts. I am Devraj Nayak, a budding bug bounty hunter and cyber security researcher. So let’s get…Continue reading on Medium » (https://medium.com/@nayakdevraj010/my-first-bug-reflected-xss-3f4ba2ba1cc6?source=rss------bug_bounty-5)
Bypass the windows defender and other AVs and execute shellcode remotely via C#
https://www.reddit.com/r/redteamsec/comments/pr5npw/bypass_the_windows_defender_and_other_avs_and/
<!-- SC_OFF -->So lately I have been learning techniques involved in red teaming and evading AVs took my attention. I found AVs use signature matching and modern AVs like windows defender uses behaviour detection. In this, I have created a snippet that will exchange the keys on the connection (not hardcoding) and will use those keys to encrypt and decrypt data. Code Repository: https://github.com/tbhaxor/csharp-and-infosec See the video here: https://drive.google.com/file/d/1UsE8MgJ2dfO0xeARo_cIw956HChHgP7i/view?usp=sharing https://preview.redd.it/eiiugxrkvfo71.png?width=1920&format=png&auto=webp&s=3270191a981e221afaa17e1688e8c1fae37a00f6 <!-- SC_ON --> submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://www.reddit.com/r/redteamsec/comments/pr5npw/bypass_the_windows_defender_and_other_avs_and/) [comments] (https://www.reddit.com/r/redteamsec/comments/pr5npw/bypass_the_windows_defender_and_other_avs_and/)
https://www.reddit.com/r/redteamsec/comments/pr5npw/bypass_the_windows_defender_and_other_avs_and/
<!-- SC_OFF -->So lately I have been learning techniques involved in red teaming and evading AVs took my attention. I found AVs use signature matching and modern AVs like windows defender uses behaviour detection. In this, I have created a snippet that will exchange the keys on the connection (not hardcoding) and will use those keys to encrypt and decrypt data. Code Repository: https://github.com/tbhaxor/csharp-and-infosec See the video here: https://drive.google.com/file/d/1UsE8MgJ2dfO0xeARo_cIw956HChHgP7i/view?usp=sharing https://preview.redd.it/eiiugxrkvfo71.png?width=1920&format=png&auto=webp&s=3270191a981e221afaa17e1688e8c1fae37a00f6 <!-- SC_ON --> submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://www.reddit.com/r/redteamsec/comments/pr5npw/bypass_the_windows_defender_and_other_avs_and/) [comments] (https://www.reddit.com/r/redteamsec/comments/pr5npw/bypass_the_windows_defender_and_other_avs_and/)
QLOG - Windows Security Logging
http://www.kitploit.com/2021/09/qlog-windows-security-logging.html
http://www.kitploit.com/2021/09/qlog-windows-security-logging.html
QLOG provides enriched Event Logging for security related events on Windows based systems. It is under heavy development and currently in alpha state. QLOG doesn’t use API hooks and it doesn’t require a driver to be installed on the target system, QLOG only uses ETW to retrieve its telemetry. Currently QLOG supports “process create” events only, but other enriched events will follow soon. QLOG runs as a Windows Services, but can also run in console mode, if you want to stream the enriched events to console directly.
How does it work
QLOG reads from ETW, enriches events and writes enriched events to Event Channel “QLOG”. It creates and uses a new event source named “QMonitor” to write to Windows Eventlog. Here is sequence of event processing: Create ETW session & Subscribe to relevant kernel and userland (https://www.kitploit.com/search/label/UserLAnd) ETW providers Read Events from ETW providers Enrich Events Write enriched events to eventlog channel QLOG
Development & License
QLOG is being developed by threathunters.io community and will be open sourced once it reaches production grade maturity.
Why we created QLOG?
Sysmon does a great job, but we wanted to create a tool which is open source and doesn't require drivers to be installed on target systems. Also, Sysmon is NOT SUPPORTED by Microsoft (https://www.kitploit.com/search/label/Microsoft) at all. So, if you run into problems in prod, you're at your own. Sure, QLOG doesn't have support either, but it will be open sourced so we can fix issues with the power of the security community and develop new features based on the requirements (https://www.kitploit.com/search/label/Requirements) of the community.
Usage & install
QLOG requires .NET Framework >=4.7.2 to be installed. To run in interactive console mode, just run qlog.exe
To install / deinstall as Windows service, run: #install service
qlog.exe -i
#deinstall service
qlog.exe -u
Do you want to contribute?
Please see https://threathunters.io/ on how to join threathunters.io community.
Example output of enriched PROCESS CREATE events
{
"EventGuid": "68795fe8-67e7-410b-a5c0-8364746d7ffe",
"StartTime": "2021-07-11T11:06:56.9621746+02:00",
"QEventID": 100,
"QType": "Process Create",
"Username": "TESTOS\\TESTUSER",
"Imagefilename": "TEAMS.EXE",
"KernelImagefilename": "TEAMS.EXE",
"OriginalFilename": "TEAMS.EXE",
"Fullpath": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
"PID": 21740,
"Commandline": "\"C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe\" --type=renderer --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --field-trial-handle=1668,499009601563875864,12511830007210419647,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=de --enable-wer --ms-teams-less-cors=522133263 --app-user-model-id=com.squirrel.Teams.Teams --app-path=\"C:\\Users \\jocke",
"Modulecount": 41,
"TTPHash": "42AC63285408F5FD91668B16F8E9157FD97046AB63E84117A14E31A188DDC62F",
"Imphash": "F14F00FA1D4C82B933279C1A28957252",
"sha256": "155625190ECAA90E596CB258A07382184DB738F6EDB626FEE4B9652FA4EC1CC2",
"md5": "9453BC2A9CC489505320312F4E6EC21E",
"sha1": "7219CB54AC535BA55BC1B202335A6291FDC2D76E",
"ProcessIntegrityLevel": "None",
"isOndisk": true,
"isRunning": true,
"Signed": "Signature valid",
"AuthenticodeHash": "B8AD58EE5C35B3F80C026A318EEA34BABF6609C077CB3D45AEE69BF5C9CF8E11",
"Signatures": [
{
"Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "15.12.2020 22:24:20",
"NotAfter": "02.12.2021 22:24:20",
"DigestAlgorithmName": "SHA256",
How does it work
QLOG reads from ETW, enriches events and writes enriched events to Event Channel “QLOG”. It creates and uses a new event source named “QMonitor” to write to Windows Eventlog. Here is sequence of event processing: Create ETW session & Subscribe to relevant kernel and userland (https://www.kitploit.com/search/label/UserLAnd) ETW providers Read Events from ETW providers Enrich Events Write enriched events to eventlog channel QLOG
Development & License
QLOG is being developed by threathunters.io community and will be open sourced once it reaches production grade maturity.
Why we created QLOG?
Sysmon does a great job, but we wanted to create a tool which is open source and doesn't require drivers to be installed on target systems. Also, Sysmon is NOT SUPPORTED by Microsoft (https://www.kitploit.com/search/label/Microsoft) at all. So, if you run into problems in prod, you're at your own. Sure, QLOG doesn't have support either, but it will be open sourced so we can fix issues with the power of the security community and develop new features based on the requirements (https://www.kitploit.com/search/label/Requirements) of the community.
Usage & install
QLOG requires .NET Framework >=4.7.2 to be installed. To run in interactive console mode, just run qlog.exe
To install / deinstall as Windows service, run: #install service
qlog.exe -i
#deinstall service
qlog.exe -u
Do you want to contribute?
Please see https://threathunters.io/ on how to join threathunters.io community.
Example output of enriched PROCESS CREATE events
{
"EventGuid": "68795fe8-67e7-410b-a5c0-8364746d7ffe",
"StartTime": "2021-07-11T11:06:56.9621746+02:00",
"QEventID": 100,
"QType": "Process Create",
"Username": "TESTOS\\TESTUSER",
"Imagefilename": "TEAMS.EXE",
"KernelImagefilename": "TEAMS.EXE",
"OriginalFilename": "TEAMS.EXE",
"Fullpath": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
"PID": 21740,
"Commandline": "\"C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe\" --type=renderer --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --field-trial-handle=1668,499009601563875864,12511830007210419647,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=de --enable-wer --ms-teams-less-cors=522133263 --app-user-model-id=com.squirrel.Teams.Teams --app-path=\"C:\\Users \\jocke",
"Modulecount": 41,
"TTPHash": "42AC63285408F5FD91668B16F8E9157FD97046AB63E84117A14E31A188DDC62F",
"Imphash": "F14F00FA1D4C82B933279C1A28957252",
"sha256": "155625190ECAA90E596CB258A07382184DB738F6EDB626FEE4B9652FA4EC1CC2",
"md5": "9453BC2A9CC489505320312F4E6EC21E",
"sha1": "7219CB54AC535BA55BC1B202335A6291FDC2D76E",
"ProcessIntegrityLevel": "None",
"isOndisk": true,
"isRunning": true,
"Signed": "Signature valid",
"AuthenticodeHash": "B8AD58EE5C35B3F80C026A318EEA34BABF6609C077CB3D45AEE69BF5C9CF8E11",
"Signatures": [
{
"Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "15.12.2020 22:24:20",
"NotAfter": "02.12.2021 22:24:20",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "E8C15B 4C98AD91E051EE5AF5F524A8729050B2A2",
"TimestampSignatures": [
{
"Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:3BBD-E338-E9A1, OU=Microsoft America Operations, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "12.11.2020 19:26:02",
"NotAfter": "11.02.2022 19:26:02",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "E8220CE2AAD2073A9C8CD78752775E29782AABE8",
"Timestamp": "15.06.2021 00:39:50 +02:00"
}
]
},
{
"Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "15.12.2020 22:31:47",
"NotAfter": "02. 12.2021 22:31:47",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "C774204049D25D30AF9AC2F116B3C1FB88EE00A4",
"TimestampSignatures": [
{
"Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:F87A-E374-D7B9, OU=Microsoft Operations Puerto Rico, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "14.01.2021 20:02:23",
"NotAfter": "11.04.2022 21:02:23",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "ED2C601EDD49DD2A934D2AB32DCACC19940161EF",
"Timestamp": "15.06.2021 00:39:53 +02:00"
}
]
}
],
"ParentProcess": {
"EventGuid": null,
"StartTime": "2021-07-11T09:54:28.9558001+02:00",
"QEventID": 100,
"QType": "Process Create",
"Username": "TEST- OS\\TESTUSER",
"Imagefilename": "",
"KernelImagefilename": "",
"OriginalFilename": "TEAMS.EXE",
"Fullpath": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
"PID": 16232,
"Commandline": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe ",
"Modulecount": 162,
"TTPHash": "",
"Imphash": "F14F00FA1D4C82B933279C1A28957252",
"sha256": "155625190ECAA90E596CB258A07382184DB738F6EDB626FEE4B9652FA4EC1CC2",
"md5": "9453BC2A9CC489505320312F4E6EC21E",
"sha1": "7219CB54AC535BA55BC1B202335A6291FDC2D76E",
"ProcessIntegrityLevel": "Medium",
"isOndisk": true,
"isRunning": true,
"Signed": "Signature valid",
"AuthenticodeHash": "B8AD58EE5C35B3F80C026A318EEA34BABF6609C077CB3D45AEE69BF5C9CF8E11",
"Signatures": [
{
"Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=W ashington, C=US",
"Issuer": "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "15.12.2020 22:24:20",
"NotAfter": "02.12.2021 22:24:20",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "E8C15B4C98AD91E051EE5AF5F524A8729050B2A2",
"TimestampSignatures": [
{
"Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:3BBD-E338-E9A1, OU=Microsoft America Operations, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "12.11.2020 19:26:02",
"NotAfter": "11.02.2022 19:26:02",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "E8220CE2AAD2073A9C8CD78752775E29782AABE8",
"Timestamp": "15.06.2021 00:39:50 +02:00"
}
]
},
{
"Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"TimestampSignatures": [
{
"Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:3BBD-E338-E9A1, OU=Microsoft America Operations, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "12.11.2020 19:26:02",
"NotAfter": "11.02.2022 19:26:02",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "E8220CE2AAD2073A9C8CD78752775E29782AABE8",
"Timestamp": "15.06.2021 00:39:50 +02:00"
}
]
},
{
"Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "15.12.2020 22:31:47",
"NotAfter": "02. 12.2021 22:31:47",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "C774204049D25D30AF9AC2F116B3C1FB88EE00A4",
"TimestampSignatures": [
{
"Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:F87A-E374-D7B9, OU=Microsoft Operations Puerto Rico, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "14.01.2021 20:02:23",
"NotAfter": "11.04.2022 21:02:23",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "ED2C601EDD49DD2A934D2AB32DCACC19940161EF",
"Timestamp": "15.06.2021 00:39:53 +02:00"
}
]
}
],
"ParentProcess": {
"EventGuid": null,
"StartTime": "2021-07-11T09:54:28.9558001+02:00",
"QEventID": 100,
"QType": "Process Create",
"Username": "TEST- OS\\TESTUSER",
"Imagefilename": "",
"KernelImagefilename": "",
"OriginalFilename": "TEAMS.EXE",
"Fullpath": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
"PID": 16232,
"Commandline": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe ",
"Modulecount": 162,
"TTPHash": "",
"Imphash": "F14F00FA1D4C82B933279C1A28957252",
"sha256": "155625190ECAA90E596CB258A07382184DB738F6EDB626FEE4B9652FA4EC1CC2",
"md5": "9453BC2A9CC489505320312F4E6EC21E",
"sha1": "7219CB54AC535BA55BC1B202335A6291FDC2D76E",
"ProcessIntegrityLevel": "Medium",
"isOndisk": true,
"isRunning": true,
"Signed": "Signature valid",
"AuthenticodeHash": "B8AD58EE5C35B3F80C026A318EEA34BABF6609C077CB3D45AEE69BF5C9CF8E11",
"Signatures": [
{
"Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=W ashington, C=US",
"Issuer": "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "15.12.2020 22:24:20",
"NotAfter": "02.12.2021 22:24:20",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "E8C15B4C98AD91E051EE5AF5F524A8729050B2A2",
"TimestampSignatures": [
{
"Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:3BBD-E338-E9A1, OU=Microsoft America Operations, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "12.11.2020 19:26:02",
"NotAfter": "11.02.2022 19:26:02",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "E8220CE2AAD2073A9C8CD78752775E29782AABE8",
"Timestamp": "15.06.2021 00:39:50 +02:00"
}
]
},
{
"Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "15.12.2020 22:31:47",
"NotAfter": "02.12.2021 22:31:47",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "C774204049D25D30AF9AC2F116B3C1FB88EE00A4",
"TimestampSignatures": [
{
"Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:F87A-E374-D7B9, OU=Microsoft Operations Puerto Rico, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "14.01.2021 20:02:23",
"NotAfter": "11.04.2022 21:02:23",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "ED2C601EDD49DD2A934D2AB32DCACC19940161EF",
"Timestamp": "15.06.2021 00:39:53 +02:00"
}
]
}
],
"ParentProcess": null
}
}
Download QLOG (https://github.com/threathunters-io/QLOG)
"NotAfter": "02.12.2021 22:31:47",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "C774204049D25D30AF9AC2F116B3C1FB88EE00A4",
"TimestampSignatures": [
{
"Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:F87A-E374-D7B9, OU=Microsoft Operations Puerto Rico, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"NotBefore": "14.01.2021 20:02:23",
"NotAfter": "11.04.2022 21:02:23",
"DigestAlgorithmName": "SHA256",
"Thumbprint": "ED2C601EDD49DD2A934D2AB32DCACC19940161EF",
"Timestamp": "15.06.2021 00:39:53 +02:00"
}
]
}
],
"ParentProcess": null
}
}
Download QLOG (https://github.com/threathunters-io/QLOG)