DARPA - Operationally Transparent Cyber (OpTC) Data Release - multi-day dataset that includes endpoint activity (including benign activity generation) from ~500 endpoints as well as Zeekurity data from the enterprise egress point.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - FiveDirections/OpTC-data
Contribute to FiveDirections/OpTC-data development by creating an account on GitHub.
KAPE - A Beginner's Guide
🗣deltawing
Best viewed not on mobile due to size of visual aids.
👤deltawing
🎖@malwr
🗣deltawing
Best viewed not on mobile due to size of visual aids.
👤deltawing
🎖@malwr
AboutDFIR - The Definitive Compendium Project
KAPE - AboutDFIR - The Definitive Compendium Project
A detailed guide on how to use KAPE geared towards first-timers and visual learners.
Rom Hacking tool for Gameboy Advance game + detailed manual about how it was developed + talks
🗣bmacabeus
Awesome stuff, man.
👤Streiw
🎖@malwr
🗣bmacabeus
Awesome stuff, man.
👤Streiw
🎖@malwr
GitHub
GitHub - macabeus/klo-gba.js: 🧢 Reverse engineering tool for the Klonoa's GBA game
🧢 Reverse engineering tool for the Klonoa's GBA game - macabeus/klo-gba.js
Bypassing Symantec Endpoint Protection for Fun & Profit!
🗣input0
This is fun, but missing some details.
1. Version of Symantec Endpoint Protection tested is not listed. SEP14.3 came out a couple weeks ago and adds new capabilities including AMSI (finally).
1. Test was conducted on Windows 2012R2. Yes, Windows 2012R2 is still widespread in production and under support, however Windows 10/2016 have enhancements that make dumping credentials much more difficult (LSAS virtualization in Virtualization Bases Security).
Without this information, this blog really is "I walked through an intentionally vulnerable pen testing lab scenario", vs. "here is a demonstration that you should do something and actionable guidance on what you should do". (IE, you should upgrade your fleet to 2016/10, etc).
👤R-EDDIT
🎖@malwr
🗣input0
This is fun, but missing some details.
1. Version of Symantec Endpoint Protection tested is not listed. SEP14.3 came out a couple weeks ago and adds new capabilities including AMSI (finally).
1. Test was conducted on Windows 2012R2. Yes, Windows 2012R2 is still widespread in production and under support, however Windows 10/2016 have enhancements that make dumping credentials much more difficult (LSAS virtualization in Virtualization Bases Security).
Without this information, this blog really is "I walked through an intentionally vulnerable pen testing lab scenario", vs. "here is a demonstration that you should do something and actionable guidance on what you should do". (IE, you should upgrade your fleet to 2016/10, etc).
👤R-EDDIT
🎖@malwr
House of Io – Bypassing Safe-Linking and attacking Glibc's tcache
🗣eyalitki
Very interesting! I remember noticing the same thing about the first chunk but didn’t think much about. Good work getting a new exploit type out of the mitigation’s.
👤mdulin2
In a classic "Thank you /r/netsec" /u/awarau888 and I were able to develop their initial attack variant that was posted here a few days ago, into a working bypass.
👤eyalitki
🎖@malwr
🗣eyalitki
Very interesting! I remember noticing the same thing about the first chunk but didn’t think much about. Good work getting a new exploit type out of the mitigation’s.
👤mdulin2
In a classic "Thank you /r/netsec" /u/awarau888 and I were able to develop their initial attack variant that was posted here a few days ago, into a working bypass.
👤eyalitki
🎖@malwr
awarau
House of Io – Remastered
A few days ago, I (Awarau) published a blog post (link) with my analysis of the new heap mitigation, Safe-Linking, that will be introduced in GLibc 2.32. The blog post describes the mechanism, alon…