EDRSandblast

EDRSandBlast EDRSandBlast est un outil écrit en C qui exploite un pilote signé vulnérable pour contourner les détections EDR callbacks de routines de notification, callbacks d'objets et fournisseur ETW TI et les protections LSASS. De multiples techniques de désaccrochage unhooking en mode...

EDRSandblast-GodFault

EDRSandblast-GodFault Par Gabriel Landau chez Elastic Security. Modification de EDRSandblast – voir le README original ci-dessous. Intègre GodFault dans EDR Sandblast, obtenant le même résultat sans utiliser de pilote vulnérable. Exemple de sortie C:\Users\user\Desktop\OffsetsEDRSandblast.exe...

Russian SVR-Linked APT29 Targets JetBrains TeamCity Servers in Ongoing Attacks

Threat actors affiliated with the Russian Foreign Intelligence Service SVR have targeted unpatched JetBrains TeamCity servers in widespread attacks since September 2023. The activity has been tied to a nation-state group known as APT29, which is also tracked as BlueBravo, Cloaked Ursa, Cozy Bear,...

EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections Kernel callbacks and ETW TI provider and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. As of release, combination of userland...