Building an RDP Credential Catcher for Threat Intelligence
https://research.nccgroup.com/2021/01/10/building-an-rdp-credential-catcher-for-threat-intelligence/
https://research.nccgroup.com/2021/01/10/building-an-rdp-credential-catcher-for-threat-intelligence/
PROCESS HERPADERPING – WINDOWS DEFENDER EVASION
https://pentestlaboratories.com/2021/01/18/process-herpaderping-windows-defender-evasion/
https://pentestlaboratories.com/2021/01/18/process-herpaderping-windows-defender-evasion/
Pentest Laboratories
Process Herpaderping – Windows Defender Evasion
Windows Defender has improved significantly the security posture of Windows environments since it has better detection capabilities compare to other security products. When a process is created Win…
Security Advisory: MSRPC Printer Spooler Relay (CVE-2021-1678)
https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/
https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/
CrowdStrike.com
Security Advisory: MSRPC Printer Spooler Relay (CVE-2021-1678)
On Patch Tuesday, January 12, 2021, Microsoft released a patch for CVE-2021-1678, an important vulnerability discovered by CrowdStrike researchers.
New campaign targeting security researchers
https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
Google
New campaign targeting security researchers
Details on an ongoing campaign, which we attribute to a government-backed entity based in North Korea, targeting security researchers working on vulnerability research and development.
Alaid TechThread
New campaign targeting security researchers https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
рекомендуется провести проверку на наличие угроз
Facebook AI Introduces N-Bref: A Neural-Based Decompiler Framework
https://www.marktechpost.com/2021/01/28/facebook-ai-introduces-n-bref-a-neural-based-decompiler-framework/
https://www.marktechpost.com/2021/01/28/facebook-ai-introduces-n-bref-a-neural-based-decompiler-framework/
MarkTechPost
Facebook AI Introduces N-Bref: A Neural-Based Decompiler Framework
Facebook AI introduces a neural-based decompiler framework called N-Bref, which improves traditional decompilation systems’ performance accuracy. The research led by Jishen Zhao is a collaboration between FAIR and UCSD STABLE Lab. This study presents a comprehensive…
WINDOWS KERNEL ZERO-DAY EXPLOIT (CVE-2021-1732) IS USED BY BITTER APT IN TARGETED ATTACK
https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/
https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/
Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins
https://github.com/liamg/traitor
https://github.com/liamg/traitor
GitHub
GitHub - liamg/traitor: :arrow_up: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit,…
:arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock - GitHub - liamg/traitor: :arrow_up: :fire: ...
Hunting for Bugs in Windows Mini-Filter Drivers
https://googleprojectzero.blogspot.com/2021/01/hunting-for-bugs-in-windows-mini-filter.html?m=1
https://googleprojectzero.blogspot.com/2021/01/hunting-for-bugs-in-windows-mini-filter.html?m=1
Blogspot
Hunting for Bugs in Windows Mini-Filter Drivers
Posted by James Forshaw, Project Zero In December Microsoft fixed 4 issues in Windows in the Cloud Filter and Windows Overlay Filter (WOF) d...
HAFNIUM targeting Exchange Servers with 0-day exploits
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
Microsoft News
HAFNIUM targeting Exchange Servers with 0-day exploits
Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. In the attacks observed, threat actors used this vulnerability to access on-premises Exchange servers, which…
malicious repositories can execute remote code while cloning
https://www.openwall.com/lists/oss-security/2021/03/09/3
https://www.openwall.com/lists/oss-security/2021/03/09/3
Playing in the (Windows) Sandbox
https://research.checkpoint.com/2021/playing-in-the-windows-sandbox/
https://research.checkpoint.com/2021/playing-in-the-windows-sandbox/
Check Point Research
Playing in the (Windows) Sandbox - Check Point Research
Research By: Alex Ilgayev Introduction Two years ago, Microsoft released a new feature as a part of the Insiders build 18305 – Windows Sandbox. This sandbox has some useful specifications: Integrated part of Windows 10 (Pro/Enterprise). Runs on top of Hyper…