Source Byte

I like their vibe 😌

سلام دوستان وقتتون بخیر، انشالله امروز یه لایو ساعت 18 در خدمتتون هستم، روی APT 28 🇷🇺تا جایی که شد تاکتیک میریم جلو https://youtube.com/live/M1JeQv-bhNM?feature=share

#Article Design a real-time data processing By Ramin Farajpour در این مقاله شما با طراحی سیستم بلادرنگ [ real-time data processing] اشنا می شوید.این سیستم به منظور اقدامات ضروری برای سناریو های تصمیم گیری مانند کشف تقلب، معاملات سهام، سیستم‌های نظارت یا ضد ویروس‌ها، حیاتی است. 1- Apache Kafka (Data Ingestion) 2- Apache Flink (Stream Processing) 3- Apache Druid (Analytics and Querying) 4- CEPFlink ( Complex Event Processing) 5- Kubernetes (Scalability) 6- Data Storage (Apache Cassandra or Amazon Kinesis) 🦅 کانال بایت امن | گروه بایت امن _

Note during self-study OSEP course from the Internet. https://github.com/col-1002/OSEP-Notes/tree/main

ProxyAlloc: evading NtAllocateVirtualMemory detection ft. Elastic Defend & Binary Ninja In this article, we will explore a method for in-process shellcode execution evasion. This method is specifically designed to avoid the detection of NtAllocateVirtualMemory calls from unsigned DLLs. https://blog.cryptoplague.net/main/research/windows-research/proxyalloc-evading-ntallocatevirtualmemory-detection-ft.-elastic-defend-and-binary-ninja credit : Daniil Nababkin

gpu poisoning; hide the payload inside the gpu memory. https://github.com/H1d3r/GPU_ShellCode.git

Function Graph Overview https://marketplace.visualstudio.com/items?itemName=tamir-bahar.function-graph-overview

How to get the COM concurrency model for the current thread. by Rbmm & Dennis A. Babkin https://dennisbabkin.com/blog/?t=things-you-thought-you-knew-how-to-get-com-concurrency-model-for-current-thread #com #reverse_engineer #cpp

RedTeam Workshop - Part 4 * How do North Korean hackers bypass security mechanisms? * APT38 attacks simulation , in this section, "defense evasion" was discussed.

Defense Evasion + T1562.003 | Impair Command History Logging + T1562.004 | Disable or Modify System Firewall + T1070.001 | Clear Windows Event Logs + T1070.006 | Timestomp + T1112 | Modify Registry + T1218.001 | Compiled HTML File + T1218.011 | Rundll32

https://youtu.be/zDyPRrtXjus?si=265TY6KyElHGr-eR slides / notes : https://github.com/soheilsec/RT-workshop-2024 credit : @soheilsec language : persian

LOLESXi * Living Off The Land ESXi

COM PROCESS INJECTION for RUST

Process Injection via Component Object Model (COM) IRundown::DoCallback().

https://github.com/0xlane/com-process-inject.git

x64 WINAPI Recursive Loader

"Code provided by smelly - vx-underground"

https://web.archive.org/web/20240928164510/https://github.com/Evi1Grey5/Recursive-Loader #Loader

The Anti-EDR Compendium EDR functionality and bypasses in 2024, with focus on undetected shellcode loader. https://blog.deeb.ch/posts/how-edr-works/ credit : Dobin Rutishauser

Охуенная статья Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/

Injecting Code into Windows Protected Processes using COM, Part 1 and Part 2 by James Forshaw of the Project Zero team prompted an interest in COM internals and, more specifically, the undocumented DoCallback method part of the IRundown interface. - POC #COM

😈 [ Check Point Research @_CPResearch_ ] 10 years of DLL hijacking - featuring abused executables that shouldn't have existed, exported and malicious DLLs with discount bin "packing." Includes a PoC for app developers to pre-emptively stop hijacking without dealing with a certificate authority. 🔗 https://research.checkpoint.com/2024/10-years-of-dll-hijacking-and-what-we-can-do-to-prevent-10-more/ 🐥 [ tweet ]

Kimsuky Group's new backdoor appeared (HappyDoor) https://web.archive.org/web/20240626161026/https://asec.ahnlab.com/ko/67128/

Kimsuky Group's new backdoor appeared (HappyDoor)