Source Byte

tl;dr modify shell open command (default) to malicious payload with subsequent invocation of text editor + parameters. The .txt file won't be malicious, but the thing responsible for opening them will be ¯\_(ツ)_/¯

"Can a .txt file be malicious?" Short answer: No Long answer: Anything is possible through the power of Windows HKEY_CLASSES_ROOT

Inspired Shell Obfuscatio https://github.com/CyberSecurityN00b/shellfeck

Linux internals https://youtube.com/playlist?list=PLSIUOFhnxEiC3YTdxwqZqgEY5imVL8U8J&si=kVQOBW8ZFk33yYM- https://youtube.com/playlist?list=PLOEpetqiDZSrfM_HYPe9l6RC782Ttul2H&si=9nk4B_uVAbL2VtSK https://youtube.com/playlist?list=PLsI2APLEA9Eq6z8zUlOJrqmc5KBwLTV4A&si=oW0Nqinw5PgTw27q

Kimsucky analysis part2 https://somedieyoungzz.github.io/posts/kimsucky-2/ #malware_analysis

Rhysida Ransomware Link #malware_analysis

some good ETW blog posts [ 1 ] ETW visualization [ 2 ] Uncovering Windows Events [ 3 ] ETW internals for security research and forensics [ 4 ] Exploiting a “CVE-2020-1034” Vulnerability – In 35 Easy Steps or Less! [ 5 ] Design issues of modern EDRs: bypassing ETW-based solutions [ 6 ] A Primer On Event Tracing For Windows (ETW) [ 7 ] Windows 10 ETW Events references collection [ 8 ] evading EDR book [ 1 ] , [ 2 ] [ 9 ] Detecting In-Memory Threats with Kernel ETW Call Stacks [ 10 ] Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers [ 11 ] A Begginers All Inclusive Guide to ETW [ 12 ] ETW References [ 13 ] Give Me an E, Give Me a T, Give Me a W. What Do You Get? RPC! (pars events from the RPC ETW) [ 14 ] Attacks on ETW Blind EDR Sensors ( black hat con ) [ 15 ] This write-up will present a case study of using ETW (Event Tracing for Windows) to analyze an active Cobalt Strike Beacon that was still active and communicating to it's C2 Server. [ 16 ] coming soon ... ——— @islemolecule_source

Event Tracing for Windows (ETW): Your Friendly Neighborhood IPC Mechanism https://www.preludesecurity.com/blog/event-tracing-for-windows-etw-your-friendly-neighborhood-ipc-mechanism credit : @jsecurity101

Event Tracing for Windows (ETW): Your Friendly Neighborhood IPC Mechanism

Organized list of my malware development resources https://github.com/rootkit-io/awesome-malware-development #malware_dev

Dissecting SnakeKeyLogger Macros https://farghlymal.github.io/Dissecting-SnakeKeyLogger-Macros/

Lost in Transaction: Process Doppelgänging Tal Liberman Eugene Kogan https://docs.google.com/viewerng/viewer?url=https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf

Password :GREENARMOR MalDev Academy Malware Development 2024

This write-up covers the basics of working with Native Applications and some interesting things you can do with them. https://www.protexity.com/post/going-native-malicious-native-applications #tweet Credit: Steve S.

Unveiling custom packers: A comprehensive guide https://estr3llas.github.io/unveiling-custom-packers-a-comprehensive-guide/

If you've ever wanted to live debug user mode Linux processes (e.g.: in WSL) from WinDbg, with 1.2402.24001.0, you can! Start up a gdbserver in WSL (e.g.: gdbserver localhost:1234 ./vim) and connect to it via WinDbg's "Connect to remote debugger" Documentation for live Linux debugging with WinDbg can be found at: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/linux-live-remote-process-debugging And https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/linux-dwarf-symbols #tweet Credit : William R. Messmer