Detecting Manual Syscalls from User Mode https://winternl.com/detecting-manual-syscalls-from-user-mode/
winternl
Detecting Manual Syscalls from User Mode
By now direct system calls are ubiquitous in offensive tooling. Manual system calls remain effective for evading userland based EDRs. From within userland, there has been little answer to this…
DNS exfiltration of data: step-by-step simple guide https://hinty.io/devforth/dns-exfiltration-of-data-step-by-step-simple-guide/
hinty.io
DNS exfiltration of data: step-by-step simple guide
Complete Guide to Windows File System Auditing https://www.varonis.com/blog/windows-file-system-auditing/
Varonis
Complete Guide to Windows File System Auditing - Varonis
Windows file auditing is key in a cybersecurity plan. Learn about file system auditing and why you'll need an alternate method to get usable file audit data
Security of the Intel Graphics Stack https://igor-blue.github.io/2021/02/10/graphics-part1.html
Igor's Blog
Security of the Intel Graphics Stack - Part 1 - Introduction
General Architecture Core Graphics 2D Graphics Pipeline 3D Graphics Pipeline The Execution Units (EUs) The GuC Boot ROM and GuC firmware The μOS kernel Communication with the OS Host Graphics…
Windows kernel zero-day exploit (CVE-2021-1732) is used by BITTER APT in targeted attack https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/
Last update needed for Zerologon, finally available » CVE-2020-1472: Microsoft Finalizes Patch for Zerologon to Enable Enforcement Mode by Default https://www.tenable.com/blog/cve-2020-1472-microsoft-finalizes-patch-for-zerologon-to-enable-enforcement-mode-by-default
Tenable®
CVE-2020-1472: Microsoft Finalizes Patch for Zerologon to Enable Enforcement Mode by Default
Zerologon has quickly become valuable to nation-state threat actors and ransomware gangs, making it imperative for organizations to apply these patches immediately if they have not yet done so. Background On February 9, as part of its February 2021 Patch…
Malware Analysis Report (AR21-039A) https://us-cert.cisa.gov/ncas/analysis-reports/ar21-039a
Domestic Kitten – An Inside Look at the Iranian Surveillance Operations https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/
Check Point Research
Domestic Kitten – An Inside Look at the Iranian Surveillance Operations - Check Point Research
Overview Despite the reveal of “Domestic Kitten” by Check Point in 2018, APT-C-50 has not stopped conducting extensive surveillance operations against Iranian citizens that could pose a threat to the stability of the Iranian regime, including internal dissidents…
Deobfuscate malicious macro – Part 0x1 https://www.securityinbits.com/malware-analysis/deobfuscate-malicious-macro/
Securityinbits
Deobfuscate malicious macro - Part 0x1 - Securityinbits
We will concentrate on malicious macro embedded in Emotet downloader office document and see how to deobfuscate the macro code.
Lazarus/Bluenoroff/APT38 indictments » Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and
Department of Justice
Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe
A federal indictment unsealed today charges three North Korean computer programmers with participating in a wide-ranging criminal conspiracy to conduct a series of destructive cyberattacks, to steal and extort more than $1.3 billion of money and cryptocurrency…
Offensive Windows IPC Internals 2: RPC https://csandker.io/2021/02/21/Offensive-Windows-IPC-2-RPC.html
csandker.io
Offensive Windows IPC Internals 2: RPC
Remote Procedure Calls (RPC) is a technology to enable data communication between a client and a server across process and machine boundaries (network communication). Therefore RPC is an Inter Process Communication (IPC) technology...
Exploit Writeup for CVE-2021–3156 (Sudo Baron Samedit) https://datafarm-cybersecurity.medium.com/exploit-writeup-for-cve-2021-3156-sudo-baron-samedit-7a9a4282cb31
Medium
Exploit Writeup for CVE-2021–3156 (Sudo Baron Samedit)
A Sudo vulnerability (CVE-2021–3156) found by Qualys, Baron Samedit: Heap-Based Buffer Overflow in Sudo, is a very interesting issue…
RCE on a Laravel Private Program https://zdresearch.com/rce-on-a-laravel-private-program/
ZDResearch
RCE on a Laravel Private Program - ZDResearch
The recent Laravel CVE enables remote attackers to exploit a RCE flaw in websites using Laravel. I’ve read the article about the exploitation procedure using the Ignition library on Laravel. To get started, I went through our recon database which contains…
Is Math.random() Safe? from missing rate limit to bypass 2fa and possible sqli https://neroli.medium.com/is-math-random-safe-from-missing-rate-limit-to-bypass-2fa-and-possible-sqli-2a4ea66f82c5
Medium
Is Math.random() Safe? from missing rate limit to bypass 2fa and possible sqli
Hi everyone It’s Yasser Again,
Nice post to start analyzing Android binaries » CrackMe challenges for Android https://persianov.net/crackme-challenges-for-android
Persianov on Security
CrackMe challenges for Android
Some crackme challenges for Android. Sorted in 3 different difficulty levels and easy to run on any Android emulator. Download and try your RE skills!
Tracking Cryptocurrency Malware In The Homelab - Pt 2 https://www.archcloudlabs.com/projects/tracking-crypto-miners-in-the-homelab-2-new-tricks/
Arch Cloud Labs
Tracking Cryptocurrency Malware In The Homelab - Pt 2
About The Project Continuing from the last blog post that discussed malicious Linux Cryptocurrency miners, I have discovered new activity that blends two of my previous Cryptocurrency mining malware (aka Cryptojacking) blog posts.
By taking a deeper look…
By taking a deeper look…
Analysis of CVE-2021-1647 vulnerability exploitation techniques (worth reading, but in Chinese; use Google Translator) » https://www.anquanke.com/post/id/231625
UnhookMe: Dynamically unhooking imports resolver https://securityonline.info/unhookme-dynamically-unhooking-imports-resolver/
Penetration Testing
UnhookMe: Dynamically unhooking imports resolver • Penetration Testing
UnhookMe presents us with the first MessageBoxW that is not subject for hooking. Then we hook MessageBoxW prologue ourselves