Windows Detection Engineer @SentinelOne Opinions are my own
Joined October 2018
- Tweets359
- Following1.2K
- Followers347
- Likes1.1K
Petar Jr. Pranic retweeted
6 months before @porchetta_ind's events unfolded, I paused updating my FOSS tools, questioning their value. To rediscover this and shape future developments, I've opened a private server for ppl to share ideas or even just connect.
Interested? Join! discord.gg/u2AZcuGr
Petar Jr. Pranic retweeted
🎁 GIVEAWAY TIME! 🎁 - I'm giving away 2 seats for my brand new "Hands-On Kusto Query Language (KQL) for Security Analysts" course!
Please follow @BluRavenSec , Comment, and Repost to participate.
👉 academy.bluraven.io/hands-on…
Two random winners will be announced on 5 December 2023.
#kql #microsoftsentinel #microsoftdefender #microsoftxdr #threathunting #dfir #detectionengineering
Petar Jr. Pranic retweeted
Here's Process Stomping injection and how you can use it in a Mockingjay-ish way to load a Beacon on a exe's RWX section using sRDI. Check it out!
Blog: naksyn.com/edr%20evasion/202…
Tool: github.com/naksyn/ProcessSto…
Thanks to @hasherezade and @monoxgas for their awesome work
Petar Jr. Pranic retweeted
And finally our #defcon31 talk is also on YouTube! 😁
youtu.be/_2lH90C2nOM?si=qHlJ…
Petar Jr. Pranic retweeted
#RomHackTraining started this morning
Dirk-jan Mollema (Azure AD Security) and Silvio Cesare (Code review) teaching our studends right now 🔥🔥🔥
Petar Jr. Pranic retweeted
More to come in the upcoming weeks
Me and @Her0_IT did a fair bit of research against one of the leading EDRs in the sector. This first post will hopefully be the start of a long saga, documenting all of our findings.
This first part was dated back in 2020:
riccardoancarani.github.io/2…
Petar Jr. Pranic retweeted
Ever wondered how to pull a Houdini on #auditd and let linux events vanish into thin air? Dive into our latest blog post by @qtc_de and meet the magic wands ^H^H^H PoCs 'daphne' & 'apollon' 😎 code-white.com/blog/2023-08-…
Petar Jr. Pranic retweeted
Check out ScrapingKit by @myexploit2600 and I on @Lares_ Labs, a tool we've been working on for the past week and a half focused on picking up quick wins in windows environments, useful for both #blueteam and #redteam purposes. labs.lares.com/introducing-s…
Petar Jr. Pranic retweeted
Introducing ETWHash!
ETWHash is a new method and tool by @lefterispan for consuming SMB events from Event Tracing for Windows (ETW) and extracting NetNTLMv2 hashes for cracking offline.
labs.nettitude.com/blog/etwh…
Petar Jr. Pranic retweeted
New major roadrecon release is out! This release adds supports for:
- Eligible AAD admin roles (PIM)
- Scoped and custom roles
- Administrative Units
All now in the GUI and readable by any member user in the tenant (yes including eligible roles)😀github.com/dirkjanm/ROADtool…
Petar Jr. Pranic retweeted
This Thursday March 9th, @MrUn1k0d3r will be presenting "Windows Internals for Red Teams" in the Prelude community discord at 7 PM EST. Drop in, chat, and learn about Windows internals! discord.gg/fZbfdUQM4A #infosec #redteam
Petar Jr. Pranic retweeted
Me: Spend hours building custom malware to bypass the most sophisticated defenses on the market.
Real threat actors: Meterpreter goes brrrrr
BumbleBee Zeros in on Meterpreter
➡️Initial Access: Contact Forms/Stolen Images/ISO
➡️PrivEsc: WSReset & Slui UAC Bypass, Zerologon CVE2020-1472
➡️Cred Access: Procdump LSASS, reg dump SAM/SEC/SYS hives
➡️C2: BumbleBee, Meterpreter, CobaltStrike
thedfirreport.com/2022/11/14…
1/X
Petar Jr. Pranic retweeted
Hey hackers! Our team is at #RomHackCamp by @cybersaiyanIT and already started pwning the badges 👀
Pop to say hi and talk about AppSec and Red Teaming!
Spoiler: Our team is looking for talented people to grow 📈
Petar Jr. Pranic retweeted
☢️ Can confirm: Macros killed in Office 365, 2207 (Build 15427.20210)
1. if doc has MOTW, macros are disabled.
2. if doc is opened from MOTW flagged ISO/IMG, macros are disabled
ISOs are no longer effective containers for MOTW evasion.
However, bundling payloads into LNK is 🔥
Petar Jr. Pranic retweeted
From initial access to Global Admin with #BloodHound and BARK.
In this thread let's walk, step by step, through an example attack path based on real configurations we've seen in real environments:
Petar Jr. Pranic retweeted
I don't have access to a @PayPal business account, but @atjontv does, and was able to recreate this exact attack, explaining the one part I was unsure on, and confirming the rest. (Screenshots in thread, shared with permission) 🧵
I got a really convincing phish today from @PayPal. And when I say "from Paypal", the from address is [email protected]. I knew right away that I didn't have a PayPal account for this email, so I was sure it was fake. It took me a minute to figure out what I was looking at. 🧵
Petar Jr. Pranic retweeted
Similar to Petitpotam, the netdfs service is enabled in Windows Server and AD environments, and the abused RPC method allows privileged processes to access malicious pipes for exploitation github.com/crisprss/magicNet…
Petar Jr. Pranic retweeted
After a lot of effort, I thought to share my browser exploitation journey of an old Firefox Integer Overflow bug: voidsec.com/browser-exploita… Please, be clement as it's my 2nd time tackling browser exploitation and report back any messy explanation or if I missed some important bits.
