A PoC of Transacted Hollowoing, a PE injection technique (by @hasherezade) https://github.com/hasherezade/transacted_hollowing
GitHub
GitHub - hasherezade/transacted_hollowing: Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and…
Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging - hasherezade/transacted_hollowing
Forensic Analysis: jackcr difr challenge https://digitalitskills.com/forensic-analysis-jackcr-difr-challenge/
Guide to P-code Injection: Changing the intermediate representation of code on the fly in Ghidra https://swarm.ptsecurity.com/guide-to-p-code-injection/
32 bits, 32 gigs, 1 click... Exploitation of a JavaScriptCore WebAssembly Vulnerability https://blog.ret2.io/2021/06/02/pwn2own-2021-jsc-exploit/
RET2 Systems Blog
32 bits, 32 gigs, 1 click...
In this post we will examine a vulnerability in the WebAssembly subsystem of JavaScriptCore, the JavaScript engine used in WebKit and Apple Safari. The issue...
Threat Hunting: Log Monitoring Lab Setup with ELK https://www.hackingarticles.in/threat-hunting-log-monitoring-lab-setup-with-elk/
Hacking Articles
Threat Hunting: Log Monitoring Lab Setup with ELK
Learn Threat hunting with ELK log monitoring lab setup, configuration & analysis for security incident response & threat detection techniques
Revisiting the NSIS-based crypter https://blog.malwarebytes.com/threat-analysis/2021/05/revisiting-the-nsis-based-crypter/
ThreatDown by Malwarebytes
Revisiting the NSIS-based crypter - ThreatDown by Malwarebytes
This blog post was authored by hasherezade NSIS (Nullsoft Scriptable Install System) is a framework dedicated to creating software installers. It…
Malware Can Use This Trick to Bypass Ransomware Defense in Antivirus Solutions https://thehackernews.com/2021/06/malware-can-use-this-trick-to-bypass.html
The Hacker News
Malware Can Use This Trick to Bypass Ransomware Defense in Antivirus Solutions
Malware Can Use This New Trick to Bypass Ransomware Defense in Popular Antivirus Solutions
iOS Malicious Bit Hunter: malicious plug-in detection engine for iOS applications https://securityonline.info/ios-malicious-bit-hunter/
Cybersecurity News
iOS Malicious Bit Hunter: malicious plug-in detection engine for iOS applications
iOS Malicious Bit Hunter can analyze the head of the macho file of the injected dylib dynamic library based on runtime, and can perform behavior analysis
QT: heap overflow in TIFF processing https://bugs.chromium.org/p/project-zero/issues/detail?id=2165
The Nansh0u Campaign – Hackers Arsenal Grows Stronger https://www.guardicore.com/labs/the-nansh0u-campaign-hackers-arsenal-grows-stronger/
Guardicore
The Nansh0u Campaign – Hackers Arsenal Grows Stronger - Guardicore
During the past two months, the Guardicore Labs team has been closely following a China-based campaign which aimed to infect Windows MS-SQL and phpMyAdmin servers worldwide. We have taken a deep look into the inner workings of the campaign – the tools in…
SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/
Check Point Research
SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor - Check Point Research
Introduction Check Point Research identified an ongoing surveillance operation targeting a Southeast Asian government. The attackers use spear-phishing to gain initial access and leverage old Microsoft Office vulnerabilities together with the chain of in…
CVE-2021-30660 - XNU Kernel Memory Disclosure https://alexplaskett.github.io/CVE-2021-30660/
Amit Merchant - Software Engineer
CVE-2021-30660 - XNU Kernel Memory Disclosure
The msgrcv_nocancel syscall could disclose uninitialized memory from kernel space into userspace. This is due to an incorrect calculation being performed when copying the memory.
Analysis report of the Facefish rootkit https://blog.netlab.360.com/ssh_stealer_facefish_en/
360 Netlab Blog - Network Security Research Lab at 360
Analysis report of the Facefish rootkit
Background
In Feb 2021, we came across an ELF sample using some CWP’s Ndays exploits, we did some analysis, but after checking with a partner who has some nice visibility in network traffic in some China areas, we discovered there is literarily 0 hit for…
In Feb 2021, we came across an ELF sample using some CWP’s Ndays exploits, we did some analysis, but after checking with a partner who has some nice visibility in network traffic in some China areas, we discovered there is literarily 0 hit for…
Abusing LNK "Features" for Initial Access and Persistence https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
v3ded.github.io
Abusing LNK "Features" for Initial Access and Persistence
Preface Today we’ll talk about the misuse of .LNK trigger keys as a means of achieving initial access and persistence. I first heard about this topic myself ...
The Race to Native Code Execution in PLCs https://www.claroty.com/2021/05/28/blog-research-race-to-native-code-execution-in-plcs/
Claroty
Siemens PLC Software Vulnerabilities Uncovered | Team82
Claroty has found a severe memory protection bypass vulnerability (CVE-2020-15782) in Siemens PLC Software, the SIMATIC S7-1200 and S7-1500. Learn more.
Memory Analysis For Beginners With Volatility — Coreflood Trojan: Part 2 https://infosecwriteups.com/memory-analysis-for-beginners-with-volatility-coreflood-trojan-part-2-42bdb46683f2
Medium
Memory Analysis For Beginners With Volatility
Hello everyone, welcome back to my memory analysis series. If you didn’t read the first part of the series — go back and read it here: