Paul L retweeted
This will be a thread discussing a real world breach involving a drone delivered exploit system that occurred this summer
Some details I am not able to discuss, however for the blue teams & red teams out there I hope this provides a good measure of capability.
🧵🚁 🎮🖥️🦠
Paul L retweeted
For over a year, EasyAntiCheat's virtual machine code to asses kernel driver integrity was vulnerable to attacks abusing call hierarchy (the hierarchy of which functions are executed during integrity)
Full write-up here: bright.engineer/posts/easyan…
Paul L retweeted
Ilya Lichtenstein and his wife, Heather Rhiannon Morgan, laundered 119,745BTC ($4,500,000,000) from a crypto exchange breach which occured in 2016. They were arrested today.
Heather Morgan was a @Forbes contributor and rapper. This is her music video.
youtube.com/watch?v=_DIuPPmY…
Paul L retweeted
[Tooling ⚔️] Updated DInjector with the 'CurrentThreadUuid' technique (based on a blog post by Sunggwan Choi): shellcode in a list of UUID strings ➡️ HeapCreate & UuidFromStringA to convert and copy the SC ➡️ EnumSystemLocalesA to trigger the callback 🔥 github.com/snovvcrash/DInjec…
Paul L retweeted
I found an internal undocumented API thanks to this: stackoverflow.com/a/41078568
Paul L retweeted
Been a few months in development on and off, but finally got an end to end POC working for lsarelayx. System wide NTLM relay from Windows which relays all incoming NTLM authentications without affecting the original target application. Silent relay if you will.
Paul L retweeted
Interesting paper from @SolomonSklash - PE image sections encrypting and decrypting when the process is asleep (Sleep / NtDelayExecution).
Paul L retweeted
🧠 Mental models are useful for developing solutions and stimulating thinking. In this post, I discuss some personal mental models I've found useful for offensive capability R&D, which can also generalize to understanding opponent processes in InfoSec.
jackson-t.ca/operational-men…
Paul L retweeted
Fundamentals of Metal Milling with Jacob Botden ift.tt/3Dq20K2 #classes
Paul L retweeted
Manage resource-based constrained delegation using impacket. Enables abusing PetitPotam/ntlmrelayx to compromise non-dc host when SMB signing is enabled:
petitpotam->ntlmrelayx->adcs->cert->rubeus->tgt->delegateAccess.py->getSt.py->PWN
github.com/p3nt4/impacket/bl…
Paul L retweeted
New version of Reflective Loader that checks beacon process to see if DLL's are already loaded to limit callbacks from LoadLibrary API. Also custom getSymbolAddress function written in assembly to reduce hits to GetProcAddress API... And code refactor!
github.com/boku7/CobaltStrik…
Paul L retweeted
A sneak peek of #Sysmon for Linux 💥
Thank you @kevsecurity for your hard work and for sharing your research @eBPFsummit ! #ebpf #eBPFSummit
🚨 Release scheduled for early October 2021 🚨
Looking forward to it 🍻 #MSTIC R&D team 😎
Paul L retweeted
It was the most time consuming #ThreatIntel report in my career😤
#REvil TTPs hunting campaign is finished:
- 37 detection ideas
- 81 detection rules (Windows/Sysmon/EDR)
plus BloodHound & BITS jobs:
bit.ly/2XAEx8h
Excellent work @TheDFIRReport team!
#threathunting
Paul L retweeted
So, this is awkward, It's not you, it's us. We're still in our PJs, quarantine hair, kinda preferring it that way.
We're gonna tar.gz the con into one day, virtual, Nov 6th. The CFP will open Sept 1.
Watch bsidesto.ca for detail^H^HWARNING! InComIng GAmE CuBe
Paul L retweeted
Sysmon has a feature, CopyOnDeletePE, which if enabled keeps a copy of any PE file being deleted. This could snag attacker tools when they delete them, saving forensic recovery time. Public now.
📎docs.microsoft.com/en-us/sys…
Paul L retweeted
We have aggregated samples from 'Indra', the group responsible for the attacks against the Iranian Railways, and the Ministry of Roads & Urban Development systems.
* Download: tmpsend.com/PxaRTRJm
* File self-deletes in 7 days
* Paper: research.checkpoint.com/2021…
Paul L retweeted
We have successfully archived the Conti affiliate training material - a compilation of various RedTeaming videos, RedTeaming tools, malicious powershell scripts, etc. This is essentially the Conti 'continual education' program.
You can download it here: pastebin.com/U71YVjjy