Source Byte

C2 development guide https://www.soheilsec.com/توسعه-بدافزار-c2 Language: Persian credit: @soheilsec #c2 ,

C2 development guide https://www.soheilsec.com/توسعه-بدافزار-c2 Language: Persian credit: @soheilsec #c2 ,

Writing A Decent Win32 Keylogger synacktiv.com/publications/w… #key_logger

Reminder that creating a memory dump of Outlook.exe not only produces access tokens but also potentially sensitive email content. Stealing Access Tokens From Office Desktop Applications : https://mrd0x.com/stealing-tokens-from-office-applications/ credit : @mrd0x #memory_dump ,

creating a Rootkit to Learn C credit : @h0mbre_ https://h0mbre.github.io/Learn-C-By-Creating-A-Rootkit/# #rootkit ,

Perfect DLL Hijacking elliotonsecurity.com/perfect… #dll_hijacking

Writing a simple 16 bit VM in less than 125 lines of C https://andreinc.net/2021/12/01/writing-a-simple-vm-in-less-than-125-lines-of-c #VM

Someone post it on Twitter and got 5k views and 90 likes while you don't even share post to others 👀

Using Office VBA Macro to exploit a vulnerable driver (zam64.sys) using DeviceIoControl, to get NTAUTHORITY\SYSTEM TL;DR - Ring 0 using Office Doc} Credit: @0xDISREL https://disrel.com/posts/Ring0VBA-Getting-Ring0-Using-a-Goddamn-Word-Document/ #driver , #exploitation, #VBA

How GitLab's Red Team automates C2 testing Credit: @eip_4141 https://about.gitlab.com/blog/2023/11/28/how-gitlabs-red-team-automates-c2-testing/ #c2 ,

Needles Without The Thread: Threadless Process Injection  https://m.youtube.com/watch?si=UlFxll8AwTtMM0Cz&v=z8GIjk0rfbI&feature=youtu.be Credit : @0xclient #thread , #process_injection

Needles Without The Thread: Threadless Process Injection  Credit : @0xclient

Analyzing AsyncRAT's Code Injection into aspnet_compiler.exe Across Multiple Incident Response Cases trendmicro.com/en_us/researc… #AsyncRAT , #code_injection , #analysis

+ why are you laughing? - nothing 😂 #mem

decoded PowerShell script that perform C2 connection. The script decodes and executes commands received from a C2 server by using R64Decoder Function. this tool was used by an APT to target @bellingcat https://gist.github.com/whichbuffer/22621545f9f5a1d946affd34f6659e64 #c2 , #powershell , #tool

ROOTCON Media Server “/ROOTCON 16/Talks/” https://media.rootcon.org/ROOTCON%2016/Talks/ #malware_dev