Just T04ST!Ng some cpus
Joined June 2022
- Tweets23
- Following17
- Followers60
- Likes35
Have you watched my talk on #DirectSyscalls and #InlineAssembly
At @IntentSummit yet? Check it out :
youtu.be/2qlc8cisaKA
To all @IntentSummit attendees, see you Sunday !
@CyberArk @Checkmarx #evasion #maldev #infosec #redteam #EDR
One of my favorites from our latest research
So we showed you how we use vulnerable drivers to steal tokens for a new process.
That is obviously not enough.
How about editing your current process token?
Check this:
spikysabra.gitbook.io/kernel…
github.com/SpikySabra/Kernel…
No token is safe 😈
Access tokens are the beating heart of a process.
stealing tokens is an important method attackers need in order to escalate their privileges.
What if you could steal both local and AD tokens with one command line?
Well..now you can !
Check this out :
spikysabra.gitbook.io/kernel…
Killing an EDR? NO PROBLEM!
A lot has been said about removing hooks and kernel callbacks to stop an EDR from detecting malicious activity.
What if we could terminate the process completely?
Well ...we can.
Check this out:
spikysabra.gitbook.io/kernel…
T045T3R retweeted
PPL can be very pesky when you try to dump some creds.
Sometimes all you wish for is to turn it off with a click of a button.
Well... Your wish is our "command".
Want to know how?
Click this:
spikysabra.gitbook.io/kernel…
Feeling proud.
Our latest research is out now!
Enjoy the read, test the code, and let us know your thoughts!
Bring Your Own Vulnerable Driver.
Just two weeks since we learnt how the infamous Lazarus group has carried major cyber attacks using CVE-2021-21551.
What if we could re-create that code?
what about mitigations ?
Check out our latest research and repo:
spikysabra.gitbook.io/kernel…