SoheilSec

I gathered samples related to Attack Against Iran’s State Broadcaster if you have access to those three missing files plz share it in group file pass : infected credits : vx-underground MalwareBazaar checkpoint

❓Think your EDR solution is bullet proof? 🔥 Intuitive threat actors now leverage Windows Filtering Platform rules to block EDRs from alerting the SOC Team. ⬇️ ⚙️ Specifically, EDRSilencer is a very neat opensource tool that detects running EDR processes and uses custom Windows Filtering Platform (WFP) rules to block outbound communications between the EDR agent on a workstation or sever to the EDR management server. This means that alerts don’t make it to the SOC team or IT department and are not aware of the system being compromised. ⬇️ EDRSilencer on Github: https://github.com/netero1010/EDRSilencer 📰 Kudos to TrendMicro on their article covering this topic in detail: https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html 🛡How to block this attack? While TrendMicro notes that blocking EDRSilencer is one prevention method; there is nothing stopping threat actors from just crafting another app that calls WFP to block EDR agent communications. A better detection method for a SOC team would be to log WFP events and specifically alert on 5155 & 5157 event IDs (WFP blocked apps and connections) which are filtered in your SIEM platform by the Application Name which equals the path of your EDR agent. 📕WFP Event Auditing: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-connection Ref:https://www.linkedin.com/posts/christiancscott_think-your-edr-solution-is-bullet-proof-activity-7252879878260170753-XrF4/?utm_source=share&utm_medium=member_android

DEF CON 32 talk Windows Downdate: Downgrade Attacks Using Windows Updates https://youtu.be/HHmxuxQ7bE8?si=zYrdh420K0nHVmtB

IntelBroker, in collaboration with EnergyWeaponUser and zjj, claims to be selling data from a recent Cisco breach. The compromised data reportedly includes GitHub and GitLab projects, SonarQube projects, source code, hardcoded credentials, certificates, customer SRCs, confidential Cisco documents, Jira tickets, API tokens, AWS private buckets, Cisco technology SRCs, Docker builds, Azure storage buckets, private and public keys, SSL certificates, and Cisco premium products. Several high-profile companies, including Verizon, AT&T, Bank of America, Barclays, British Telecom, Microsoft, Vodafone, and Chevron, are allegedly impacted. Samples have been provided. https://x.com/H4ckManac/status/1845884053574025416?t=xWMDW5t78xM9OUg5Olx7fA&s=19

CVE-2024-43582: RCE in RDP Servers, 8.1 rating❗️ A use after free vulnerability in some RDP servers could allow an attacker to carry out remote code execution. https://app.netlas.io/responses/?q=protocol%3Ardp%20geo.country%3AIR&page=1&indices=

metasploit 15% active + attacks 41% mitre 15% owasp top 10 29% طبق تجمیع دو نظر سنجی آموزش اکتیو‌دایرکتوری + حملات به صورت عملی میریم جلو تقریبی 20 تا قسمتی باید بشه که تمام حملات کاور بشه و سعی میکنم بیس شبکه بیشتر توضیح بدم چون میدونم این بیس شبکه بین کسانی که شروع میکنن خیلی کمرنگ هست جهت حمایت از بنده کانال ساب کنید حتما نظرتتان کامنت بزارید که آموزش کاربردی جلو بره https://youtube.com/@soheilsec

The PrintNightmare is not Over Yet: https://itm4n.github.io/printnightmare-not-over/

سلام وقت بخیر، امروز ساعت 18 (قسمت آخر) لایو #ردتیم در خدمتتون هستم با APT 28 Simulation🇷🇺 و تاکتیک‌های باقی مانده کاور میکنم. ریپو براش ساختم بعد از اتمام لایو هر چی کامند، پیلود هست آپلود میکنم براتون که بعدا بتونید استفاده کنید https://youtube.com/live/5E8vsvT4Rvc?feature=share https://github.com/soheilsec/APT-28-Simulation

سلام وقت بخیر، امروز مجدد ساعت 18 لایو #ردتیم دارم APT Simulation تا جایی که بشه تاکتیک تکنیک‌های مربوط به APT28 🇷🇺 کاور میکنم. https://youtube.com/live/RYcku1kRYWE?feature=share

سلام دوستان وقتتون بخیر، انشالله امروز یه لایو ساعت 18 در خدمتتون هستم، روی APT 28 🇷🇺تا جایی که شد تاکتیک میریم جلو https://youtube.com/live/-j3OZfu7zfI?feature=share

Detecting and mitigating Active Directory compromises بجای استفاده از مشاوره این شکلی مثل ردتیم وب و اتوماتیک ردتیم با استفاده از 3 ابزار زیر شروع به هاردنینگ کنید: bloodhound Ping castle Purple Knight میشه جهت شناسایی آسیب پذیری و امن‌سازی استفاده کرد خیلی خدا تومن میگیرن برای پن تست شبکه داخلی خروجی همین ابزار فارسی میکنن به اسم گزارش میدند 🤔 https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/detecting-and-mitigating-active-directory-compromises

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ https://github.com/RickdeJager/cupshax

Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/

888 has Allegedly Leaked the Data of SAP Employees.

سلام وقت بخیر، قسمت 7(آخر) از ورکشاپ ردتیم ، شبیه سازی تاکتیک های collection c2 APT38 منتسب به کره شمالی لیست تکنیک هایی که شبیه سازی شده اند: T1115 T1005 T1071.001 T1105 https://youtu.be/KDfm-JcFt4w?si=OI1L3AbtZ8tQ0O7P