Mining Google Chrome CVE data https://clearbluejar.github.io/posts/mining-google-chrome-cve-data/
clearbluejar
Mining Google Chrome CVE data
The Google Chrome Releases blog provides CVE data one liners containing all the information needed to create a rich CVE data source. Google Chrome CVEs are plentiful and provide information for understanding Google Chrome security trends. Using the information…
Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x. https://github.com/ergrelet/unlicense
GitHub
GitHub - ergrelet/unlicense: Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x. - ergrelet/unlicense
How to Reverse Engineer and Patch an iOS Application for Beginners: Part I https://www.inversecos.com/2022/06/how-to-reverse-engineer-and-patch-ios.html
Inversecos
How to Reverse Engineer and Patch an iOS Application for Beginners: Part I
Functional Programming in Lean https://leanprover.github.io/functional_programming_in_lean/#functional-programming-in-lean
Kinsing & Dark.IoT botnet among threats targeting CVE-2022-26134 https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/
Lacework
Kinsing & Dark.IoT botnet among threats targeting CVE-2022-26134
Details regarding the recent Confluence OGNL (CVE-2022-26134) exploit were released to the public on June 3rd 2022. Shortly following this, Lacework Labs began seeing multiple attacks in the wild from both uncategorized and named threats. While this was expected…
LetsDefend- SOC 173- Follina 0-Day detected // Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability, CVE-2022–30190 https://domizianafoti.medium.com/letsdefend-soc173-follina-0-day-detected-microsoft-windows-support-diagnostic-tool-msdt-8df54efe6bad
Medium
LetsDefend- SOC 173- Follina 0-Day detected // Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability…
CVE-2022–30190 is a zero day vulnerability which has been discovered by the twitter account nao_sec.
A small collection of vulnerable code snippets https://github.com/snoopysecurity/Vulnerable-Code-Snippets
GitHub
GitHub - snoopysecurity/Broken-Vulnerable-Code-Snippets: A small collection of vulnerable code snippets
A small collection of vulnerable code snippets . Contribute to snoopysecurity/Broken-Vulnerable-Code-Snippets development by creating an account on GitHub.
Defeating Windows ASLR via low-entropy shared libraries in 2 hours https://medium.com/@mxmssh/defeating-windows-aslr-via-32-bit-shared-libraries-in-2-hours-1e225e182155
Medium
Defeating Windows ASLR via low-entropy shared libraries in 2 hours
Disclaimer: Opinions expressed are solely my own and do not express the views or opinions of my current employer or any former employers.
Tracking WMI Activity with PSGumshoe https://www.darkoperator.com/blog/2022/3/27/tracking-wmi-activity-with-psgumshoe
“Under the hood of Wslink’s multilayered virtual machine" (REcon'22 talk) https://github.com/eset/wslink-vm-analyzer/blob/master/slides/WslinkVMREcon.pdf
GitHub
wslink-vm-analyzer/slides/WslinkVMREcon.pdf at master · eset/wslink-vm-analyzer
WslinkVMAnalyzer is a tool to facilitate analysis of code protected by a virtual machine featured in Wslink malware - eset/wslink-vm-analyzer
BlackCat — In a Shifting Threat Landscape, It Helps to Land on Your Feet: Tech Dive https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive
AdvIntel
BlackCat — In a Shifting Threat Landscape, It Helps to Land on Your Feet: Tech Dive
By Vitali Kremez, Marley Smith & Yelisey Boguslavskiy This report is part one of AdvIntel’s new series on the ALPHV (aka BlackCat) ransomware group. In the upcoming part two, AdvIntel will hold an analytical lens on BlackCat’s organizational, recruitment…
Using Windows Event Log IDs for Threat Hunting https://fourcore.io/blogs/threat-hunting-with-windows-event-log-sigma-rules
FourCore
Using Windows Event Log IDs for Threat Hunting
Windows logs every action with a unique event ID. Security analysts can utilize these logs for threat hunting and enrich detections to identify attackers efficiently. Let's take a look at the different tools and Event IDs you can use for threat hunting
CVE-2022-26937: Microsoft Windows Network File System NLM Portmap Stack Buffer Overflow https://www.zerodayinitiative.com/blog/2022/6/7/cve-2022-26937-microsoft-windows-network-file-system-nlm-portmap-stack-buffer-overflow
Zero Day Initiative
Zero Day Initiative — CVE-2022-26937: Microsoft Windows Network File System NLM Portmap Stack Buffer Overflow
In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Guy Lederfein and Jason McFadyen of the Trend Micro Research Team detail a recently patched code execution vulnerability in the Microsoft Windows operating system. The bug…
Multi-factor Authentication In-The-Wild bypass methods https://medium.com/proferosec-osm/multi-factor-authentication-in-the-wild-bypass-methods-689f53f0b62b
Medium
Multi-factor Authentication In-The-Wild bypass methods
Introduction
ecapture: capture SSL/TLS text content without CA cert using eBPF, supports Linux x86_64/Aarch64, Android(GKI) Aarch64 https://github.com/ehids/ecapturev
Patch Tuesday to End; Microsoft Announces Windows Autopatch https://www.bankinfosecurity.com/patch-tuesday-to-end-microsoft-announces-windows-autopatch-a-18885
Bankinfosecurity
Patch Tuesday to End; Microsoft Announces Windows Autopatch
Starting in July, the second Tuesday of every month will "just be another Tuesday," Microsoft says. After releasing patches for vulnerabilities in its
Popping Eagle: How We Leveraged Global Analytics to Discover a Sophisticated Threat Actor https://unit42.paloaltonetworks.com/popping-eagle-malware/
Unit 42
Popping Eagle: How We Leveraged Global Analytics to Discover a Sophisticated Threat Actor
We observed a specially crafted DLL hijacking attack used by a previously unknown piece of malware that we dubbed Popping Eagle.
CVE-2022-1040 Sophos XG Firewall Authentication bypass https://blog.viettelcybersecurity.com/cve-2022-1040-sophos-xg-firewall-authentication-bypass/