Zero-Day Exploitation of Atlassian Confluence https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Volexity
Zero-Day Exploitation of Atlassian Confluence
UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to […]
Rapidly evolving IoT malware EnemyBot now targeting Content Management System servers and Android devices https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers
LevelBlue
Rapidly evolving IoT malware EnemyBot now targeting Content…
Executive summary LevelBlue Labs™ has been tracking a new IoT botnet dubbed “EnemyBot”, which is believed to be distributed by threat actor Keksec. During our investigations, LevelBlue Labs has discovered that EnemyBot is expanding its capabilities, exploiting…
New malware Campaign delivers Android RAT
https://blog.cyble.com/2022/05/26/new-malware-campaign-delivers-android-rat/
https://blog.cyble.com/2022/05/26/new-malware-campaign-delivers-android-rat/
Offensive Windows IPC Internals 1: Named Pipes https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html
Is exploiting a null pointer deref for LPE just a pipe dream? https://www.zerodayinitiative.com/blog/2022/6/1/is-exploiting-a-null-pointer-deref-for-lpe-just-a-pipe-dream
Zero Day Initiative
Zero Day Initiative — Is exploiting a null pointer deref for LPE just a pipe dream?
A lot of blog posts I have read go over interesting vulnerabilities and exploits but do not typically share the process behind discovery. I want to show how sometimes just manually poking around can quickly uncover vulnerabilities you might miss with other…
Mining Google Chrome CVE data https://clearbluejar.github.io/posts/mining-google-chrome-cve-data/
clearbluejar
Mining Google Chrome CVE data
The Google Chrome Releases blog provides CVE data one liners containing all the information needed to create a rich CVE data source. Google Chrome CVEs are plentiful and provide information for understanding Google Chrome security trends. Using the information…
Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x. https://github.com/ergrelet/unlicense
GitHub
GitHub - ergrelet/unlicense: Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x. - ergrelet/unlicense
How to Reverse Engineer and Patch an iOS Application for Beginners: Part I https://www.inversecos.com/2022/06/how-to-reverse-engineer-and-patch-ios.html
Inversecos
How to Reverse Engineer and Patch an iOS Application for Beginners: Part I
Functional Programming in Lean https://leanprover.github.io/functional_programming_in_lean/#functional-programming-in-lean
Kinsing & Dark.IoT botnet among threats targeting CVE-2022-26134 https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/
Lacework
Kinsing & Dark.IoT botnet among threats targeting CVE-2022-26134
Details regarding the recent Confluence OGNL (CVE-2022-26134) exploit were released to the public on June 3rd 2022. Shortly following this, Lacework Labs began seeing multiple attacks in the wild from both uncategorized and named threats. While this was expected…
LetsDefend- SOC 173- Follina 0-Day detected // Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability, CVE-2022–30190 https://domizianafoti.medium.com/letsdefend-soc173-follina-0-day-detected-microsoft-windows-support-diagnostic-tool-msdt-8df54efe6bad
Medium
LetsDefend- SOC 173- Follina 0-Day detected // Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability…
CVE-2022–30190 is a zero day vulnerability which has been discovered by the twitter account nao_sec.
A small collection of vulnerable code snippets https://github.com/snoopysecurity/Vulnerable-Code-Snippets
GitHub
GitHub - snoopysecurity/Broken-Vulnerable-Code-Snippets: A small collection of vulnerable code snippets
A small collection of vulnerable code snippets . Contribute to snoopysecurity/Broken-Vulnerable-Code-Snippets development by creating an account on GitHub.
Defeating Windows ASLR via low-entropy shared libraries in 2 hours https://medium.com/@mxmssh/defeating-windows-aslr-via-32-bit-shared-libraries-in-2-hours-1e225e182155
Medium
Defeating Windows ASLR via low-entropy shared libraries in 2 hours
Disclaimer: Opinions expressed are solely my own and do not express the views or opinions of my current employer or any former employers.
Tracking WMI Activity with PSGumshoe https://www.darkoperator.com/blog/2022/3/27/tracking-wmi-activity-with-psgumshoe
Shell is Only the Beginning
Tracking WMI Activity with PSGumshoe
WMI (Windows Management Instrumentation) is the Microsoft implementation of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards from the Distributed Management Task Force (DMTF). This allows for a unified way…
“Under the hood of Wslink’s multilayered virtual machine" (REcon'22 talk) https://github.com/eset/wslink-vm-analyzer/blob/master/slides/WslinkVMREcon.pdf
GitHub
wslink-vm-analyzer/slides/WslinkVMREcon.pdf at master · eset/wslink-vm-analyzer
WslinkVMAnalyzer is a tool to facilitate analysis of code protected by a virtual machine featured in Wslink malware - eset/wslink-vm-analyzer
BlackCat — In a Shifting Threat Landscape, It Helps to Land on Your Feet: Tech Dive https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive
AdvIntel
BlackCat — In a Shifting Threat Landscape, It Helps to Land on Your Feet: Tech Dive
By Vitali Kremez, Marley Smith & Yelisey Boguslavskiy This report is part one of AdvIntel’s new series on the ALPHV (aka BlackCat) ransomware group. In the upcoming part two, AdvIntel will hold an analytical lens on BlackCat’s organizational, recruitment…
Using Windows Event Log IDs for Threat Hunting https://fourcore.io/blogs/threat-hunting-with-windows-event-log-sigma-rules
FourCore
Using Windows Event Log IDs for Threat Hunting
Windows logs every action with a unique event ID. Security analysts can utilize these logs for threat hunting and enrich detections to identify attackers efficiently. Let's take a look at the different tools and Event IDs you can use for threat hunting