Important Windows processes for Threat Hunting

https://www.socinvestigation.com/important-windows-processes-for-threat-hunting/

#edr #detection #forensic #process

Log4jHorizon

A proof of concept for VMWare Horizon instances and allows attackers to execute code as an unauthenticated user using a single HTTP request.

Research:
https://www.sprocketsecurity.com/blog/crossing-the-log4j-horizon-a-vulnerability-with-no-return

Exploit:
https://github.com/puzzlepeaches/Log4jHorizon

#log4j #vmware #horizon #rce

Domain Escalation — ShadowCoerce (MS-FSRVP)

Coercing the domain controller machine account to authenticate to a host which is under the control of a threat actor could lead to domain compromise. The most notable technique which involves coerced authentication is the PetitPotam attack which uses the Encrypting File System Remote Protocol (MS-EFSR). However, this is not the only protocol which could be utilized for domain escalation.

Research:
https://pentestlaboratories.com/2022/01/11/shadowcoerce/

PoC:
https://github.com/ShutdownRepo/ShadowCoerce

#ad #escalation #relay #redteam

Bypass EDR with Microsoft Teams

Copy payload into:
%userprofile%\AppData\Local\Microsoft\Teams\current\

Then:
%userprofile%\AppData\Local\Microsoft\Teams\Update.exe --processStart payload.exe --process-start-args "args"

#edr #evasion #teams

Password Hash Cracking in AWS

https://www.sans.org/blog/password-hash-cracking-amazon-web-services/

#aws #cuda #hashcat

Free Labs to Learn Cloud Penetration Testing

https://flaws.cloud/
https://flaws2.cloud/
https://github.com/OWASP/Serverless-Goat
https://n0j.github.io/2017/10/02/aws-s3-ctf.html
https://github.com/torque59/AWS-Vulnerable-Lambda
https://github.com/wickett/lambhack
https://github.com/BishopFox/iam-vulnerable
https://github.com/RhinoSecurityLabs/cloudgoat
https://github.com/appsecco/attacking-cloudgoat2
https://github.com/m6a-UdS/dvca
https://github.com/OWASP/DVSA
https://github.com/nccgroup/sadcloud

#cloud #aws #pentest

AWS IAM explained for RedTeam & BlueTeam

https://infosecwriteups.com/aws-iam-explained-for-red-and-blue-teams-2dda8b20fbf7

#aws #iam #redteam #blueteam

Suspicious Named Pipe Events

https://medium.com/falconforce/falconfriday-suspicious-named-pipe-events-0xff1b-fe475d7ebd8

#windows #pipe #events #blueteam #redteam

Active Directory ACL Visualizer and Explorer

adalanche tool gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and show misconfigurations.

https://github.com/lkarlslund/adalanche

#ad #acl #visualizer #blueteam #redteam

Network Access Control (NAC) Bypass

This post will be all about Network Access Control (NAC) solutions and how they might lull you into a sense of security.

https://luemmelsec.github.io/I-got-99-problems-but-my-NAC-aint-one/

#nac #bypass #pentest

LdrLoadDll-Unhooking

https://github.com/trickster0/LdrLoadDll-Unhooking

#edr #evasion #dll #cpp

Ares

This project is a PoC loader written in C/C++ based on the Transacted Hollowing technique. It features:

— PPID spoofing
— Dynamic function resolution with API hashing
— NTDLL unhooking
— AES256 CBC Encryption
— CIG to block non-Microsoft-signed binaries

https://github.com/Cerbersec/Ares

#edr #evasion #cpp

Vergilius

A collection of Microsoft Windows kernel structures, unions and enumerations. Most of them are not officially documented and cannot be found in Windows Driver Kit (WDK) headers. The target audience of this site is driver developers and kernel researches

https://www.vergiliusproject.com/

#windows #driver #kernel

Malware Analysis: Syscalls

Great guide and overview about Syscalls and how to start diagnosing them.

https://jmpesp.me/malware-analysis-syscalls-example/

#maldev #cpp #syscall

Evading WinDefender ATP Credential Theft

https://b4rtik.github.io/posts/evading-windefender-atp-credential-theft-kernel-version/

#windows #native #api #kernel #cpp

Active Directory Checklist — Attack & Defense Cheatsheet

https://cybersecuritynews.com/active-directory-checklist/

#ad #cheatsheet #redteam #blueteam

DevSecOps pipelines

— Secrets scan
— Code scan
— Dependency check (code libraries + image packages)
— DAST
— Exposures check

Pipelines:
https://gitlab.com/whitespots-public/pipelines

Security scanners:
https://gitlab.com/whitespots-public/security-images

Example project integration:
https://gitlab.com/whitespots-public/vulnerable-python-app

#appsec #devsecops #pipelines

LDAP Relay Scan

A tool to check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication.

https://github.com/zyn3rgy/LdapRelayScan

#ad #ldap #scan #tools

Adding DCSync Permissions from Linux

https://www.n00py.io/2022/01/adding-dcsync-permissions-from-linux/

#ad #dcsync #linux

Process Ghosting

This article describes a new executable image tampering attack similar to, but distinct from, Doppelgänging and Herpaderping. With this technique, an attacker can write a piece of malware to disk in such a way that it’s difficult to scan or delete it — and where it then executes the deleted malware as though it were a regular file on disk. This technique does not involve code injection, process hollowing, or Transactional NTFS (TxF).

Research:
https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack

C# Code Snippet:
https://github.com/Wra7h/SharpGhosting

#edr #evasion #process #ghosting #csharp