@ipSlav

Windows Detection Engineer @SentinelOne Opinions are my own

ipslav.github.io
Joined October 2018
  • Tweets359
  • Following1.2K
  • Followers347
My first research and tool are finally out. If you want to deep dive into some CLR internals and understand how we can abuse it to blend-in within its own logic go check it out. Hope you'll enjoy the read. ipslav.github.io/2023-12-12-…

Let Me Manage Your AppDomain

Abuse the CLR memory (un)safety

ipslav.github.io
8
72
8
183
32,240
Petar Jr. Pranic retweeted
klez
@KlezVirus15 Dec 2023
6 months before @porchetta_ind's events unfolded, I paused updating my FOSS tools, questioning their value. To rediscover this and shape future developments, I've opened a private server for ppl to share ideas or even just connect. Interested? Join! discord.gg/u2AZcuGr

Discord - Group Chat That’s All Fun & Games

Discord is great for playing games and chilling with friends, or even building a worldwide community. Customize your own space to talk, play, and hang out.

discord.com
1
10
32
9,513
Thanks everyone for the amazing replies, I'm flabbergasted by them. I wanted to thanks my friends @Her0_IT, @Void_Sec, @KlezVirus and @naksyn for their support and peer-review on this blogpost.
5
5
514
Also, biggest shoutout of all to @ShielderSec whose sponsored this research and made all of this a reality! Not every company allows you to do that, so if you want to uncover new stuff with us please reach out 🔥
2
223
Huge credits to @MrUn1k0d3r , @_xpn_ , @_ForrestOrr , @daem0nc0re and @d_tranman for their previous researches and PoCs.
2
5
1,151
Petar Jr. Pranic retweeted
Mehmet Ergene
@Cyb3rMonk1 Dec 2023
🎁 GIVEAWAY TIME! 🎁 - I'm giving away 2 seats for my brand new "Hands-On Kusto Query Language (KQL) for Security Analysts" course! Please follow @BluRavenSec , Comment, and Repost to participate. 👉 academy.bluraven.io/hands-on… Two random winners will be announced on 5 December 2023. #kql #microsoftsentinel #microsoftdefender #microsoftxdr #threathunting #dfir #detectionengineering

Hands-On KQL for Security Analysts

academy.bluraven.io
46
71
3
80
17,737
100% accurate
Jason Lang
@curi0usJack1 Sep 2019
Time breakdown of a modern red team engagement. 😁
1
327
Petar Jr. Pranic retweeted
Naksyn@naksyn18 Nov 2023
Here's Process Stomping injection and how you can use it in a Mockingjay-ish way to load a Beacon on a exe's RWX section using sRDI. Check it out! Blog: naksyn.com/edr%20evasion/202… Tool: github.com/naksyn/ProcessSto… Thanks to @hasherezade and @monoxgas for their awesome work

Mockingjay revisisted - Process stomping and loading beacon with sRDI

Executables with RWX sections can be abused using a variation of a Process Overwriting technique dubbed Process Stomping. Using (a modified) sRDI and leveraging the new features of Cobalt Strike 4.9...

naksyn.com
3
92
253
36,259
RomHack has ended and it has been amazing. Kudos to @cybersaiyanIT for the awesome conference and an incredible training from @_dirkjan. Special thanks to @APTortellini,@KlezVirus, @naksyn, @trickster012 @Th3Zer0, @suidpit, @ila_marco_, @zi0Black, and @frycos for the great time.
5
5
13
3,457
Petar Jr. Pranic retweeted
klez
@KlezVirus17 Sep 2023
And finally our #defcon31 talk is also on YouTube! 😁 youtu.be/_2lH90C2nOM?si=qHlJ…
35
118
16,543
Come say hi 👋
Shielder@ShielderSec12 Sep 2023
"Never stop learning" - with this in mind, we couldn't have missed such a great opportunity! If you are attending these amazing training sessions too, make sure to meet our very own teammates: @Th3Zer0, @ipSlav, and @madt1m_, to talk about IT shenanigans!
3
164
#RomHackTraining started this morning Dirk-jan Mollema (Azure AD Security) and Silvio Cesare (Code review) teaching our studends right now 🔥🔥🔥
8
3
27
14,199
Petar Jr. Pranic retweeted
Her0@Her0_IT3 Aug 2023
More to come in the upcoming weeks
Riccardo@dottor_morte3 Aug 2023
Me and @Her0_IT did a fair bit of research against one of the leading EDRs in the sector. This first post will hopefully be the start of a long saga, documenting all of our findings. This first part was dated back in 2020: riccardoancarani.github.io/2…

Attacking an EDR - Part 1

Introduction DISCLAMER: This post was done in collaboration with Devid Lana. You can find his blog here: https://her0ness.github.io This post is the first of what - we hope - will be a long series of...

riccardoancarani.github.io
5
9
2,170
Petar Jr. Pranic retweeted
CODE WHITE GmbH@codewhitesec3 Aug 2023
Ever wondered how to pull a Houdini on #auditd and let linux events vanish into thin air? Dive into our latest blog post by @qtc_de and meet the magic wands ^H^H^H PoCs 'daphne' & 'apollon' 😎 code-white.com/blog/2023-08-…

CODE WHITE | Blindsiding auditd for Fun and Profit

code-white.com
3
24
1
49
15,641
Petar Jr. Pranic retweeted
Paul Rascagnères@r00tbsd12 Jul 2023
With @tlansec, we suspected a 0d and we notified MS few days ago. The infection chain was insane... Instead of a endless tweet @zcracga did a wonderful graphic. 2/4
10
131
13
375
153,353
Petar Jr. Pranic retweeted
Andy Gill
@ZephrFish30 May 2023
Check out ScrapingKit by @myexploit2600 and I on @Lares_ Labs, a tool we've been working on for the past week and a half focused on picking up quick wins in windows environments, useful for both #blueteam and #redteam purposes. labs.lares.com/introducing-s…
2
13
2
40
9,590
Introducing ETWHash! ETWHash is a new method and tool by @lefterispan for consuming SMB events from Event Tracing for Windows (ETW) and extracting NetNTLMv2 hashes for cracking offline. labs.nettitude.com/blog/etwh…

ETWHash -

ETWHash is a small C# tool used during Red Team engagements, that can consume ETW SMB events and extract NetNTLMv2 hashes for cracking offline, unlike currently documented methods.

lrqa.com
170
4
323
47,523
Petar Jr. Pranic retweeted
Dirk-jan
@_dirkjan2 May 2023
New major roadrecon release is out! This release adds supports for: - Eligible AAD admin roles (PIM) - Scoped and custom roles - Administrative Units All now in the GUI and readable by any member user in the tenant (yes including eligible roles)😀github.com/dirkjanm/ROADtool…
1
50
1
163
20,991
This Thursday March 9th, @MrUn1k0d3r will be presenting "Windows Internals for Red Teams" in the Prelude community discord at 7 PM EST. Drop in, chat, and learn about Windows internals! discord.gg/fZbfdUQM4A #infosec #redteam
1
34
3
120
24,937
I'll do an educational talk about this tomorrow in Milan. If you don't have a blue team and/or enough maturity you don't need a red team assessment and whoever is selling a red teaming without this requirements it just reducing the value of an actual red team engagement.
Justin Elze
@HackingLZ14 Jan 2023
Once again everyone doesn't need red teaming. Most of the complaints on here around the topic are people using red teaming in some capacity where they would benefit from other activities instead. That doesn't mean red teaming needs to be changed or modified.
366
Load more