Is it possible to start a process as SYSTEM using only CreateFile and WriteFile? Yes

Spoiler: Write a custom RPC client and create a temporary service using \\.\pipe\ntsvcs 🙂

https://www.x86matthew.com/view_post?id=create_svc_rpc
🗣x86matthew


🎖@malwr

Great report by threatintel

- The TA leveraged PowerShell, WMIC, ProcDump, LSASS, PsExec, AnyDesk, Winrar, and there is even evidence of it leveraging EternalBlue exploits in the backdoor.
- The campaign lasted around 18 months

*Yara rules included
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/china-apt-antlion-taiwan-financial-attacks
🗣nas_bench


🎖@malwr

EmbedExeLnk - Embedding an EXE inside a LNK with automatic execution

https://www.x86matthew.com/view_post?id=embed_exe_lnk
🗣x86matthew


🎖@malwr

We recently discovered an APT group leveraging a 0-day in Zimbra to try and steal e-mails from targeted user. We just shared details on the @Volexity blog. This is an interesting case where an XSS vulnerability is being used to facilitate cyber espionage.
https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/
🗣stevenadair


🎖@malwr

The ultimate backdoor doesn't exi-
🗣DuchyRE


🎖@malwr

a tiny DNS resolver
full program: https://github.com/jvns/tiny-resolver
🗣b0rk


🎖@malwr

Reversing Go Tip 0x0001. Here is an Assembler view of a simple, "Hello, world!" and "Hello, world again!" bin. Notice with modern Go the values about to be passed into Fprintln are in r8 on x64.
🗣mytechnotalent


🎖@malwr

My latest msdt uac bypass has been added to UACME. Thx @hFireF0X!
https://github.com/hfiref0x/UACME
🗣EmericNasi


🎖@malwr

For quite some time I wanted a command-line tool to calculate the entropy of files that was fast and supported Windows. I ended up coding my own.🙂 It could be useful for people in #malwareanalysis, #forensics, etc.
https://github.com/merces/entropy
🗣mer0x36


🎖@malwr

Hours of troubleshooting and some more evenings went into a Nim port of reflective PE loading. Learned a lot porting that one, special thanks to @am0nsec and @_EthicalChaos_ for answering all my questions regarding to issues! 🤓

https://github.com/S3cur3Th1sSh1t/Nim-RunPE
🗣ShitSecure


🎖@malwr

HijackFileHandle - Hijack a file in a remote process without code injection

A covert method of intercepting data from remote file streams (log files, etc)

https://www.x86matthew.com/view_post?id=hijack_file_handle
🗣x86matthew


🎖@malwr

Indicators of Compromise Associated with LockBit 2.0
Ransomware 🕵️👾🖥️🔐

https://www.ic3.gov/Media/News/2022/220204.pdf
🗣CryptoInsane


🎖@malwr

If anyone wants practice with packet analysis, here’s a lab I give to my Security class each semester. Includes a real PCAP from @defcon #PcapsOrItDidntHappen
https://github.com/tuftsdev/DefenseAgainstTheDarkArts/blob/gh-pages/labs/lab02-pcaps.md
🗣0xmchow


🎖@malwr

Decoding Cobalt Strike: Understanding Payloads
https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/
🗣pentest_swissky


🎖@malwr

IDACode - An Integration For IDA And VS Code Which Connects Both To Easily Execute And Debug IDAPython Scripts https://ift.tt/9jM4DvH #cybersecurity #bugbountytips #hacking #tools
🗣santosomar


🎖@malwr

The Walmart Global Tech security team write about the Sugar ransomware operation, which appears to actively target individual computers rather than entire enterprises. https://medium.com/walmartglobaltech/sugar-ransomware-a-new-raas-a5d94d58d9fb
🗣virusbtn


🎖@malwr

Cuckoo and CAPE sandbox evasion in one legitimate Windows API function call? It is possible due to issues we found in Cuckoo and CAPE monitor.


@CapeSandbox @cuckoosandbox
https://research.checkpoint.com/2022/invisible-cuckoo-cape-sandbox-evasion
🗣_CPResearch_


🎖@malwr