Source Byte

CreateSvcRpc - A custom RPC client to execute programs as the SYSTEM user https://www.x86matthew.com/view_post?id=create_svc_rpc

😈 [ Kurosh Dabbagh @_Kudaes_ ] Somebody asked if you can run a dll directly without rundll32 as you would do with an exe. You just need to remove the IMAGE_FILE_DLL flag from IMAGE_FILE_HEADER->Characteristics, which can be done with the option -e. Don't see much use for it tho ^^ 🔗 https://github.com/Kudaes/CustomEntryPoint 🐥 [ tweet ]

Anatomy of a Lumma Stealer Attack via Fake CAPTCHA Pages - Part 1 https://denwp.com/anatomy-of-a-lumma-stealer/

j00ru//vx tech blog https://j00ru.vexillium.org/articles/ #exp

Analysis of some feature of vmprotect https://sachiel-archangel.medium.com/analysis-of-vmprotect-0b28c8e47ca5 #protector

The changes to the IDAPython API in IDA 9 has broken some plugins and scripts Here's how to fix some of these issues: https://blog.junron.dev/IDAPython%20Research/IDAPython%208%20to%209.html

🔥 Iran Ethical Hackers 2016

RansomHub ransomware abuses Kaspersky TDSSKiller to disable EDR software https://www.bleepingcomputer.com/news/security/ransomhub-ransomware-abuses-kaspersky-tdsskiller-to-disable-edr-software/

⚙️From COM Object Fundamentals To UAC Bypasses A 25-minute crash course covering Tokens, Privileges, UAC, COM, and ultimately bypassing UAC. 🔗Research: https://www.youtube.com/watch?v=481SI_HWlLs 🔗Source: https://github.com/tijme/conferences/tree/master/2024-09%20OrangeCon/code #windows #com #uac #bypass

RedTeam Workshop - Part 3

Execution + T1059.001 | PowerShell + T1059.003 | Windows Command Shell + T1059.005 | Visual Basic + T1106 | Native API + T1053.005 | Scheduled Task + T1569.002 | Service Execution + T1024.002 | Malicious File Persistence + T1543.003 | Windows Service

https://www.youtube.com/watch?v=XjeIPE4g33s slides / notes : https://github.com/soheilsec/RT-workshop-2024 credit : @soheilsec language : persian