SoheilSec

Process Hollowing on Windows 11 24H2
https://hshrzd.wordpress.com/2025/01/27/process-hollowing-on-windows-11-24h2/

Process Hollowing (a.k.a. RunPE) is probably the oldest, and the most popular process impersonation technique (it allows to run a malicious executable under the cover of a benign process). It is us…

1.32K viewsSoheil, 03:25

SoheilSec

For the first time, researchers have the opportunity to test our prebuilt behavior rules against key techniques.What sets this apart? This program goes beyond the typical focus on vulnerabilities—it emphasizes rule resilience, helping us refine protections directly tied to real-world threats.🧐
https://www.elastic.co/security-labs/behavior-rule-bug-bounty

www.elastic.co

Announcing the Elastic Bounty Program for Behavior Rule Protections — Elastic Security Labs

Elastic is launching an expansion of its security bounty program, inviting researchers to test its SIEM and EDR rules for evasion and bypass techniques, starting with Windows endpoints. This initiative strengthens collaboration with the security community…

2.19K viewsSoheil, 03:30

SoheilSec

deepseek_ai 🥸🤷🏻‍♂️

🗿15🤔2😎2🆒1

2.55K viewsSoheil, 14:15

SoheilSec

Ah shit, here we go again 🤔
https://x.com/jsrailton/status/1885517753295180248?s=19

4.47K viewsSoheil, 10:24

SoheilSec

Secure Enclaves for Offensive Operations (Part I)
https://www.outflank.nl/blog/2025/02/03/secure-enclaves-for-offensive-operations-part-i/

👌1

1.74K viewsSoheil, 13:53

SoheilSec

CVE-2025-21298: A Critical Windows OLE Zero-Click Vulnerability
https://www.offsec.com/blog/cve-2025-21298

👌2

3.1K viewsSoheil, 04:04

SoheilSec

https://sensepost.com/blog/2025/psexecing-the-right-way-and-why-zero-trust-is-mandatory/

Sensepost

SensePost | Psexec’ing the right way and why zero trust is mandatory

Leaders in Information Security

👌1

1.52K viewsSoheil, 13:53

SoheilSec

Forwarded from ..: لیک‌فا | Leakfa :..

🚨 نقض جدید: اطلاعات میلیون‌ها شهروند ایرانی تحت پوشش سازمان بیمه سلامت در خطر افشای گسترده

مهاجمان توانسته‌اند به اطلاعات شخصی و بیمه‌ای شهروندان، کارکنان دولت و سایر بیمه شدگان "سازمان بیمه سلامت ایران" دسترسی پیدا کنند. هنوز جزئیات دقیقی از میزان اطلاعات به سرقت رفته و یا استفاده احتمالی از آنها منتشر نشده است. با این حال، تاکنون مجموعه بزرگی در حدود 1 میلیون خط نام، نام خانوادگی، تاریخ تولد، نام پدر، شماره ملی، شماره تلفن همراه، وضعیت حیات، شناسه بیمه گذار، نام بیمه گذار و اطلاعات دیگری از این داده‌ها توسط هکر/هکر‌ها به صورت عمومی منتشر شده است.

📌 اطلاعات افشاشده می‌تواند پیامدهای جدی مانند سرقت هویت، افزایش کلاهبرداری‌های فیشینگ و کاهش اعتماد عمومی را به دنبال داشته باشد. کاربران باید هوشیار بوده و از ارائه اطلاعات شخصی در تماس‌ها یا پیام‌های مشکوک خودداری کنند.

✅ صحت داده‌های نمونه بررسی شده و قابل تایید است!

🆔 @leakfarsi

👍2

1.57K viewsSoheil, 07:54

SoheilSec

How the NSA (Equation Group) allegedly hacked into China’s Polytechnical University 🚨

I analyzed intelligence reports from Chinese cybersecurity firms (Qihoo 360, Pangu Lab, CVERC) to aggregate the TTPs attributed to the NSA’s Equation Group (APT-C-40).

🔗 FULL BLOG 👇

‏https://www.inversecos.com/2025/02/an-inside-look-at-nsa-equation-group.html

Please note, claims from Chinese cybersecurity organisations are unverified by independent parties. I am simply sharing with you what China is presenting about NSA's cyber capabilities and how they track APT-C-40 (their name for NSA).

👍2

1.85K viewsSoheil, 07:51

SoheilSec

Exploring NTDS.dit – Part 1: Cracking the Surface with DIT Explorer
https://trustedsec.com/blog/exploring-ntds-dit-part-1-cracking-the-surface-with-dit-explorer
https://github.com/trustedsec/DitExplorer

TrustedSec

Exploring NTDS.dit – Part 1: Cracking the Surface with DIT Explorer

❤1

1.87K viewsSoheil, 19:51

SoheilSec

https://lorenzomeacci.com/advanced-initial-access-techniques
ورکشاپ زیر کاملتر موضوع باز کرده:
https://hide01.ir/initial-access-training/

👍3❤1🗿1

2.21K viewsSoheil, 18:05

SoheilSec

Bypass ASMI in 2025
https://en.r-tec.net/r-tec-blog-bypass-amsi-in-2025.html

👌2

1.53K viewsSoheil, 13:50

SoheilSec

FullBypass: bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode)
https://meterpreter.org/fullbypass-bypasses-amsi-antimalware-scan-interface-and-powershell-clm-constrained-language-mode/
https://github.com/Sh3lldon/FullBypass

❤3

2.06K viewsSoheil, 12:39

SoheilSec

A project that demonstrates embedding shellcode payloads into image files (like PNGs) using Python and extracting them using C/C++. Payloads can be retrieved directly from the file on disk or from the image stored in a binary's resources section (.rsrc)

https://wafflesexploits.github.io/posts/Hide_a_Payload_in_Plain_Sight_Embedding_Shellcode_in_a_Image_file/

https://github.com/WafflesExploits/hide-payload-in-images

WafflesExploits

Concealing Payloads: Hiding Shellcode in Image Files with Python and C/C++

Learn how to hide shellcode payloads in plain sight by embedding them into image files, such as PNGs, using Python. Discover how to store embedded images in the resources section of a binary file and extract the hidden payload using C/C++ for stealthy payload…

❤5👍1

1.67K viewsSoheil, 05:38

SoheilSec

a pure TCP RPC based script to netsync machine (and gMSA!) accounts.This script perform a netsync attack. No SMB involved
https://gist.github.com/ThePirateWhoSmellsOfSunflowers/4efeea0e405ee8a53c8aa9f4f515d9ad

1.38K viewsSoheil, 18:22

SoheilSec

Kerberoasting w/o the TGS-REQ
https://rastamouse.me/kerberoasting-without-tgs-reqs/

1.58K viewsSoheil, 18:24

SoheilSec