Patryk Czeczko

I'm giving 2 talks at @layer_one together with @c0p0x this weekend: layerone.org/schedule/ #purpleteam #malware

x33fcon.com/#!s/malware.md This year during @x33fcon we will code some covert shellcode loader in C++ @c0p0x #redteam #purpleteam #malware #workshop

Would you like to learn more about Applied #PurpleTeaming? Come and join us, @0xPat and @c0p0x tomorrow at 1500 UTC. Learn more: x33fcon.com/#!w/purple.md Free registration: x33fcon.com/#!webinarregis…

Co-trainer @c0p0x

x33fcon.com/#!/t/purple.md Check out my Applied Purple Teaming training on @x33fcon

0xpat.github.io/Malware_develo… Implementing COFF loader/injector (aka beacon object file)

0xpat.github.io/Malware_develo… Some advanced obfuscation techniques for C code

0xpat.github.io/Malware_develo… Check out compilation tips, PE overwiew, hiding imports, API hashing and calculating entropy

Eliminate huge part of lateral movement scenarios with one command: "reg.exe add HKLM\SYSTEM\CurrentControlSet\Control /v DisableRemoteScmEndpoints /t REG_DWORD /d 1" It will make Service Control Manager deaf to remote management. Everything else works properly.

Did you know that LinkedIn has a directory? linkedin.com/directory/peop…

0xpat.github.io/Malware_develo… detecting debuggers and other tricks to make dynamic analysis of malware harder

@zz0eyu I think the memory pages are not shared by default, unless there's some interaction going on from other process, like debugger for example.

@0xPat I think there's a bug in your third article.

0xpat.github.io/Malware_develo… On detecting VMs, evading sandboxes, bypassing function hooks

Detecting APT29: MITRE EDR evaluations round 2 - Jorrit Folmer - Medium -> not everyone is a winner! @jorritfolmer/detecting-apt29-mitre-edr-evaluations-round-2-a8dcf7a3f486" target="_blank" rel="nofollow noopener">medium.com/@jorritfolmer/…

Well this is awkward 😂 Nice logo tho.

In case you missed it: Im writing a multi part blog on RedELK, @OutflankNL’s open sourced tooling that acts as a red team SIEM and helps with overall improved oversight during red team operations: outflank.nl/blog/2019/02/1… outflank.nl/blog/2020/02/2… outflank.nl/blog/2020/04/0…

Wanted to demonstrate AdjustTokenPrivileges() -> SomePrivilegedCall() sequence, and failed with SetSystemTime(). And now I know: SetSystemTime() tries to adjusts privileges on it's own, not even checking the result, and then calls NtSetSystemTime() syscall. Interesting...

0xpat.github.io/Malware_develo… on developing shellcode loader