Source Byte

screenshot of it on my macbook decompiling an arm64 binary

might need to ad-hoc sign the libida64.dylib for it to launch

ایدا نسخه 9 که تازه منتشر شده یکی زحمت کرک کردنش کشید این واسه تولید لایسنس ایناشه https://zerobin.org/?d5c5cf44154895e9#C9fXArBX3K7XWXWr1hSDAACtW74v5grtj12exhWUuPNP شیوه کرکشم این دوستمون که خودش کرکش کرده نوشت: https://x.com/alula/status/1822122939677897185 @cafe_security

سند راهنمای تشخیص تکنیک دور زدن EDR با متد LayeredSyscall The detection guide document for the EDR evasion technique using the LayeredSyscall method. به همراه رول های تشخیصی ELK, Sysmon, splunk 👇👇👇👇👇👇👇👇

Windows Process Access Token and user privilege

Privileges are listed and explained at: MSDN use the Windows Privileges to elevate your rights within the OS. Priv2Admin Understanding and Abusing Process Tokens — Part I Understanding and Abusing Process Tokens — Part II‌ Access Tokens‌ Abusing Tokens Adjusting Process Token Privileges

Stealing Access Tokens From Office Desktop Applications #windows #token #internals

😭😭

PowerOfTcb

This directory covers how to use SeTcbPrivilege for educational purpose. SeTcbPrivilege is a multi puropse privilege. A user has SeTcbPrivilege is able to perform various token manipulation. For example, following token factors class can be manipulated with SeTcbPrivilege (but most of them cannot be manipulated for assigned primary token): Session ID Origin Mandatory Policy Integrity Level (downgrade operation does not require SeTcbPrivilege)

https://github.com/daem0nc0re/PrivFu/tree/main/PowerOfTcb

https://web.archive.org/web/20240719160444/http://undocumented.ntinternals.net/ Xray(actually nudes) of windows internals

#exploit Techniques for Privilege Escalation on Windows Part 1: https://www.zerodayinitiative.com/blog/2024/7/29/breaking-barriers-and-assumptions-techniques-for-privilege-escalation-on-windows-part-1 Part 2: https://www.zerodayinitiative.com/blog/2024/7/30/breaking-barriers-and-assumptions-techniques-for-privilege-escalation-on-windows-part-2 Part 3: https://www.zerodayinitiative.com/blog/2024/7/31/breaking-barriers-and-assumptions-techniques-for-privilege-escalation-on-windows-part-3

Deep Sea Phishing [ 00 ] How to Bypass EDR With Custom Payloads

If endpoint detection and response (EDR) protections keep blocking your phishing payloads, you really should learn how to write custom payloads. If you’ve never written a custom payload, this is a great place to start. If you have some experience with custom payloads, I hope I can at least simplify the way you think about payload design to make it easy and fun.

[ 01 ] Making Your Malware Look Legit to Bypasses EDR

I wanted to write this blog about several good techniques for endpoint detection and response (EDR) evasion; however, as I was writing about how to evade EDRs, I was hit with an epiphany:“EDR evasion is all about looking like legitimate software” — ph3eds, 2024

https://github.com/wikiZ/RedGuard RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.