Source Byte

Hiding In PlainSight - Proxying DLL Loads To Hide From ETWTI Stack Tracing https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/

Today I made public NativeBypassCredGuard, a tool to bypass Credential Guard by patching WDigest.dll using only NTAPI functions: https://github.com/ricardojoserf/NativeBypassCredGuard.git X: https://x.com/RicardoJoseRF

Pure Malware Development Resource Collections https://github.com/malsearchs/Pure-Malware-Development.git

Список рекомендаций к изучению, составленный исключительно из моего опыта, в том числе когда я сама с нуля погружалась в форензику. Приведу оригинал и перевод книги, если он есть, но имейте ввиду, что порой читать в оригинале лучше, как минимум чтобы не встречать диковинные переводы в стиле "атака типа водопой" Базовый уровень для вхождения в специальность (= must read): 1. Applied Incident Response, Steve Anson / Реагирование на компьютерные инциденты. Прикладной курс, Cтив Энсон 2. Incident Response Techniques for Ransomware Attacks, Oleg Skulkin / Шифровальщики, Олег Скулкин 3. Cybersecurity Ops with bash, Paul Troncone, Carl Albing / Bash и кибербезопасность, Олбинг Карл, Тронкон Пол Средний уровень: 4. Practical Memory Forensics, Svetlana Ostrovskaya / Криминалистика компьютерной памяти на практике, Светлана Островская 5. Intelligence-Driven Incident Response, Scott J. Roberts, Rebekah Brown 6. Active Directory глазами хакера, Ralf Hacker Уровень максимум: Вообще большинство книг уровнем повыше можно использовать больше как справочник или по случаю. Не стоит мучаться и читать от корки до корки просто потому что надо (но можете и почитать, если интересно) 7. File System Forensic Analysis, Brian Carrier 8. Practical Linux Forensics: A Guide for Digital Investigators, Bruce Nikkel 9. Восстановление данных. Практическое руководство, Крис Касперски, В.Е. Холмогоров Extremely high level: 10. https://www.google.com/ Все указанные файлы приложены в комментариях #books

md mz 2024 mal development by cocomeloc

Azure Attack Paths #Cloud #Azure

Also there's more things

LOLBin for Downloading Arbitrary Files C:\Windows\System32\IME\SHARED\IMEWDBLD.exe <URL> Find the downloaded file in %LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION> #windows #redteam #lolbin ——— @islemolecule_source

With thanks to https://twitter.com/br0k3ns0und For This collection

LOLOL Living Off the Living Off the Land https://br0k3nlab/lofp/ Living off the False Positive

an autogenerated collection of false positives sourced from some of the most popular rule sets. The information is categorized along with ATT&CK techniques, rule source, and data source.

https://loldrivers.io Living Off The

Land Drivers is a curated list of Windows drivers used by adversaries to bypass security controls and carry out attacks

https://gtfobins.github.io

GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems

https://lolbas-project.github.io

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques

https://lots-project.com

Attackers are using popular legitimate domains when conducting phishing, C&C, exfiltration and downloading tools to evade detection. The list of websites below allow attackers to use their domain or subdomain

https://filesec.io

File extensions being used by attackers

https://hijacklibs.net

This project provides an curated list of DLL Hijacking candidates

https://wadcoms.github.io

WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments

https://www.loobins.io

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in macOS binaries and how they can be used by threat actors for malicious purposes

https://lolapps-project.github.io

This project was made because exploitation isn’t limited to binaries using command line techniques. Both built-in and third-party applications have been used & abused for adversarial gain since the dawn of time, and knowing these methods can help when all else fail.

https://www.bootloaders.io

Curated list of known malicious bootloaders for various operating systems. The project aims to assist security professionals in staying informed and mitigating potential threats associated with bootloaders BYOL Bring Your Own Land (BYOL)

https://lothardware.com.tr

Living Off The Hardware is a resource collection that provides guidance on identifying and utilizing malicious hardware and malicious devices

https://wtfbins.wtf/

WTFBin is a binary that behaves exactly like malware, except, somehow, it’s not

https://lofl-project.github.io

Living Off the Foreign Land (LOFL) are LOFL Cmdlets and Binaries (LOFLCABs) that are capable of performing activities from the local (Offensive Windows) system to a REMOTE system.

https://persistence-info.github.io

This contains information about Windows persistence mechanisms to make the protection/detection more efficient.

https://github.com/WithSecureLabs/lolcerts

Threat actors are known to sign their malware using stolen, or even legally acquired, code signing certificates. This project aims at collecting the details of the certificates that are known to be abused in the wild by malicious actors.

https://boostsecurityio.github.io/lotp/

Inventory how development tools (typically CLIs), commonly used in CI/CD pipelines, have lesser-known RCE-By-Design features (“foot guns”), or more generally, can be used to achieve arbitrary code execution by running on untrusted code changes or following a workflow injection.

https://lolbins-ctidriven.vercel.app/

This project that aims to help cyber defenders understand how LOLBin binaries are used by threat actors during an intrusion in a graphical and digestible format.

https://lolesxi-project.github.io/LOLESXi/

This project features a comprehensive list of binaries/scripts natively available in VMware ESXi that adversaries have utilised in their operations.

https://lolrmm.io/

This project is a curated list of Remote Monitoring and Management (RMM) tools that could potentially be abused by threat actors.

#lolbins

🖨 Living Off The Land - https://lolapps-project.github.io - LOLAD - UNIX binaries - Windows binaries - A collection of resources to thrive off the land #lolbins

🖨 Living Off The Land - https://lolapps-project.github.io - LOLAD - UNIX binaries - Windows binaries - A collection of resources to thrive off the land

initial brokers now : 😋

WatchTowr POCs: CVE-2024-8068 & CVE-2024-8069 : Citrix Virtual Apps and Desktops (XEN) $versions - Unauthenticated Remote Code execution (Chain) POC/AN : https://github.com/watchtowrlabs/Citrix-Virtual-Apps-XEN-Exploit CVE-2024-47575 : Fortinet FortiManager 'Fgfmsd' $versions Unauthenticated Remote Code Execution (AKA FortiJump) POC/AN : https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575 CVE-2024-0012 & CVE-2024-9474 : PAN-OS $versions - Authentication Bypass LPE Root Command Injection (AKA Sslvpn _ Chain) POC/AN : https://github.com/watchtowrlabs/palo-alto-panos-cve-2024-0012/ @APTIRAN