Two Seven One Three

230 posts

Two Seven One Three banner
Two Seven One Three

Two Seven One Three

@TwoSevenOneT

Chief Security Officer (CSO) || Security Researcher at https://t.co/YsorB5YEAu || Penetration Tester || Red Teamer || Social Engineering Awareness Trainer

参加日 Eylül 2024
2.1K フォロー中4.6K フォロワー
Two Seven One Three がリツイート
Mr.Z
Mr.Z@zux0x3a·
I am releasing a new toolkit I built for IIS-based lateral movement and code execution within IIS worker pool process's memory. Phantom ASPX Loader & PhantomLink -- a two-part toolkit for reflectively loading native DLLs into IIS w3wp.exe worker processes via ASPX. github.com/zux0x3a/Phanto…
GIF
English
4
75
248
13.8K
Two Seven One Three がリツイート
Tim Blazytko
Tim Blazytko@mr_phrazer·
Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others. Here's the release: github.com/mrphrazer/bina…
English
3
51
272
34.7K
Two Seven One Three がリツイート
Clandestine
Clandestine@akaclandestine·
GitHub - 0xsh3llf1r3/ColdWer: Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass github.com/0xsh3llf1r3/Co…
English
0
35
124
7.9K
Two Seven One Three
Two Seven One Three@TwoSevenOneT·
@7uckzero Yes, what's important is how we make a valid service "crash". If we use a custom payload to trigger it, then the failure recovery function isn't very useful anymore.
English
0
0
0
60
Two Seven One Three
Two Seven One Three@TwoSevenOneT·
Every time I read a detection rule, I instinctively have devilish thoughts racing through my mind to bypass them😂
Steven Lim@0x534c

Detecting EDRStartupHinder in Microsoft Defender for Endpoint 🛑 EDRStartupHinder, developed by X@TwoSevenOneT, is a proof‑of‑concept tool that abuses Windows Bindlink to prevent Antivirus/EDR services from starting at boot. It achieves this by redirecting critical System32 DLLs, ultimately forcing protected processes to terminate themselves. zerosalarium.com/2026/01/edrsta… To support fellow defenders, I’ve crafted a Defender XDR Advanced Hunting KQL query that can be deployed in your environment to help monitor and detect potential use of EDRStartupHinder. 🫡 🔍 Stay vigilant, share knowledge, and strengthen our collective defenses. #CyberSecurity #ThreatDetection #MDE #EDRStartupHinder

English
1
2
40
7.1K
tom square
tom square@harold9850·
@TwoSevenOneT What do you do once crowdstrike and other major vendors make a rule for this?
English
1
0
2
312
Two Seven One Three
Two Seven One Three@TwoSevenOneT·
@isDineshHere Software is becoming increasingly complex with many functions. As a result, many issues arise.
English
2
0
2
471
Dinesh
Dinesh@isDineshHere·
@TwoSevenOneT Isn't it amazing that even today, such simple dll redirection, hijacking and simple overrides in specific registries is enough to own all security infrastructure? We tend to blame the human as the weakest link in any model. Meanwhile, literally all core software has bugs/holes.
English
2
0
4
666
Two Seven One Three
Two Seven One Three@TwoSevenOneT·
#redteam You can exploit the update functionality vulnerability of #Windows Defender to move its executable folder to a location of your choosing. After that, you can use DLL Sideloading for persistence, inject code, or simply disable it... #blueteam
Two Seven One Three tweet mediaTwo Seven One Three tweet mediaTwo Seven One Three tweet media
English
8
88
415
32.6K
Jiří Vinopal
Jiří Vinopal@vinopaljiri·
From one "unnamed" RAT: Malware dev task: "Be innovative and make sure the file is deleted." Malware dev: "Got it, boss. Let’s delete it 10× just to be sure!" 🤡🗑️💥
Jiří Vinopal tweet media
English
1
6
58
3.8K
Two Seven One Three がリツイート
rtl-sdr.com
rtl-sdr.com@rtlsdrblog·
Using the Don't Look Up Tool to Eavesdrop on Insecure Private Satellite Communications rtl-sdr.com/using-the-dont…
rtl-sdr.com tweet media
English
4
125
716
42.6K

ディスカバー

@7uckzero @jamieantisocial @0x534c @harold9850 @isDineshHere @elonmusk @BarackObama @taylorswift13