Exploring Windows UAC Bypasses : Techniques and Detection Strategies :
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
π£binitamshah
π@malwr
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
π£binitamshah
π@malwr
RE tip of the day: There are many PDF entries that can be misused by malware. For example, /Action with a /Launch argument can be used to execute an application specified with a /F entry. Arguments can be added using /P entry.
#infosec #cybersecurity #malware #reverseengineering
π£re_and_more
π@malwr
#infosec #cybersecurity #malware #reverseengineering
π£re_and_more
π@malwr
The MISP cheat sheet has been updated with a representation overview showing how MISP is used to model a security incident. It's a usually a nifty overview when you don't have the time to read all of the documentation. #CTI #ThreatIntelligence
https://www.misp-project.org/misp-training/cheatsheet.pdf
π£MISPProject
π@malwr
https://www.misp-project.org/misp-training/cheatsheet.pdf
π£MISPProject
π@malwr
This media is not supported in your browser
VIEW IN TELEGRAM
WATCH: Discover the social engineering tactics employed by #APT36 or #EarthKarkaddan actors in our latest video.
Read our full report here:
https://research.trendmicro.com/EarthKarkaddan
π£TrendMicroRSRCH
π@malwr
Read our full report here:
https://research.trendmicro.com/EarthKarkaddan
π£TrendMicroRSRCH
π@malwr
New #PEsieve/#HollowsHunter (v0.3.4): https://github.com/hasherezade/pe-sieve/releases/ & https://github.com/hasherezade/hollows_hunter/releases - with threads' callstack scan. Check it out!
π£hasherezade
π@malwr
π£hasherezade
π@malwr
BinDiff export is finally on its way : I hope to be able to publish an update in a week or twoβ¦
π£bSr43
π@malwr
π£bSr43
π@malwr
ADExplorerSnapshotβ€py updates:
- BloodHound 4.1+ output format support
- new output mode to dump all objects/attributes to NDJSON
https://github.com/c3c/ADExplorerSnapshot.py
π£c3c
π@malwr
- BloodHound 4.1+ output format support
- new output mode to dump all objects/attributes to NDJSON
https://github.com/c3c/ADExplorerSnapshot.py
π£c3c
π@malwr
GitHub
GitHub - c3c/ADExplorerSnapshot: ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHoundβ¦
ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-object dumping to NDJSON. - c3c/ADExplorerSnapshot
Bulk_extractor V2.0.0 is finished!
Download the current source code from GitHub.
I'm presenting at @The_AAFS in Seattle about the long process of "sharpening" this #DFIR tool.
https://github.com/simsong/bulk_extractor/releases/tag/v2.0.0
π£xchatty
π@malwr
Download the current source code from GitHub.
I'm presenting at @The_AAFS in Seattle about the long process of "sharpening" this #DFIR tool.
https://github.com/simsong/bulk_extractor/releases/tag/v2.0.0
π£xchatty
π@malwr
GitHub
Release bulk_extractor V2.0.0 RELEASE Β· simsong/bulk_extractor
Release 2.0.0 of bulk_extractor, a high-performance digital forensics tool that works like a "find evidence" button, pulling actionable intelligence out of disk images, files, memory dump...
I played Hayyim CTF because the organizers looked promising. There was a nice challenge to exploit a patched anti-virus and here's my write-up for it.
https://ptr-yudai.hatenablog.com/entry/2022/02/13/122744
π£ptrYudai
π@malwr
https://ptr-yudai.hatenablog.com/entry/2022/02/13/122744
π£ptrYudai
π@malwr
CTFγγγ
Writing Anti-Anti-Virus Exploit (AuViel - Hayyim CTF 2022) - CTFγγγ
Introduction I played Hayyim CTF 2022 with keymoon, st98, and theoremoon. We solved all pwn tasks there and stood the 3rd place. *1 There was a pwn challenge toβ¦
RE tip of the day: UPX structures are publically available, for example, https://buff.ly/3uAYU3L The most common ways how IoT malware authors modify them in samples is changing l_magic (UPX! signature) and p_filesize and p_blocksize fields
#infosec #malware #reverseengineering
π£re_and_more
π@malwr
#infosec #malware #reverseengineering
π£re_and_more
π@malwr
β€1
termshark: A terminal UI for tshark, inspired by Wireshark
βοΈ 6980
#golang
https://github.com/gcla/termshark
π£GolangRepos
π@malwr
βοΈ 6980
#golang
https://github.com/gcla/termshark
π£GolangRepos
π@malwr
GitHub
GitHub - gcla/termshark: A terminal UI for tshark, inspired by Wireshark
A terminal UI for tshark, inspired by Wireshark. Contribute to gcla/termshark development by creating an account on GitHub.
New blog post about analyzing a stealer distributed via MSI files! S/O to @MSAdministrator for helping me improve my MSI analysis game in a big way:
#malware #stealer #msi #msitools
https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/
π£ForensicITGuy
π@malwr
#malware #stealer #msi #msitools
https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/
π£ForensicITGuy
π@malwr
Tony Lambert
Analyzing a Stealer MSI using msitools
This post is dedicated to Josh Rickard (@MSAdministrator on Twitter) since his feedback on my blog posts has cut my triage time on MSI files down in a massive way! After writing an analysis of a MSI payload distributing njRAT, Josh hit me up on Twitter toβ¦
Abusing LNK "Features" for Initial Access and Persistence
#infosec #redteam #pentest
https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
π£CyberWarship
π@malwr
#infosec #redteam #pentest
https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
π£CyberWarship
π@malwr
VMProtect Devirtualization: An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x
https://github.com/JonathanSalwan/VMProtect-devirtualization
π£JonathanSalwan
π@malwr
https://github.com/JonathanSalwan/VMProtect-devirtualization
π£JonathanSalwan
π@malwr
GitHub
GitHub - JonathanSalwan/VMProtect-devirtualization: Playing with the VMProtect software protection. Automatic deobfuscation ofβ¦
Playing with the VMProtect software protection. Automatic deobfuscation of pure functions using symbolic execution and LLVM. - JonathanSalwan/VMProtect-devirtualization
π1
CinaRAT via HTML IDs; Protecting LSASS; Blocking Facebook Credential Exposure
https://i5c.us/p7878
π£sans_isc
π@malwr
https://i5c.us/p7878
π£sans_isc
π@malwr
Custom ReadMemory API x64 bit after @x86matthew's cool blogpost.
https://trickster0.github.io/posts/Custom-ReadMemory-API/
π£trickster012
π@malwr
https://trickster0.github.io/posts/Custom-ReadMemory-API/
π£trickster012
π@malwr
trickster0βs Nest
Custom ReadMemory API
After the great job and inspiration by x86matthew and his blogpost I decided to play with it as well for x64 bit. The NTAPI function in this method is RtlFirstEntrySList from ntdll.dll. Its definition like Matthew mentioned in his blog is similar like this:β¦