UltimateWDACBypassList

Ultimate WDAC Bypass List A centralized resource for previously documented WDAC/Device Guard/UMCI bypass techniques as well for building/managing/testing WDAC policies Note: WDAC Windows Defender Application Control has been rebranded by Microsoft as "Application Control" or "Application Control...

LOLSpoof

LOLSpoof LOLSpoof è un programma shell interattivo che spoofa automaticamente gli argomenti della riga di comando del processo avviato. Basta chiamare la tua riga di comando dall'aspetto incriminato come un LOLBin es. powershell -w hidden -enc ZwBlAHQALQBwAHIAbwBjAGUA.... e LOLSpoof farà sì che l...

lolbin-poc

lolbin-poc Pequeno PoC de usar um executável assinado pela Microsoft como lolbin. Compilação 32-bit root@kitploit: cmake -B build32 -A Win32 cmake --build build32 --config Release Compilação 64-bit root@kitploit: cmake -B build64 -A x64 cmake --build build64 --config Release Uso Baixe o WinDbg aq...

LOLBAS

Binários e Scripts "Living Off The Land" e agora também Bibliotecas Todos os diferentes arquivos podem ser encontrados por trás de uma interface elegante aqui: https://lolbas-project.github.io obrigado @ConsciousHacker por este mimo visual e a equipe do https://gtfobins.github.io/. Este repositór...

Threat-Hunting

Threat-Hunting | Ingegneria del Rilevamento Raccolta di query di caccia alle minacce e rilevamento per: CrowdStrike Falcon usando CQL – CrowdStrike Query Language Microsoft Defender XDR usando KQL – Kusto Query Language Mirate a far emergere processi sospetti, comportamenti di rete anomali, binar...

Decoding the DNA of Ransomware Attacks: Unveiling the Anatomy Behind the Threat

Decoding the DNA of Ransomware Attacks: Unveiling the Anatomy Behind the Threat By Trellix Advanced Research Center · August 28, 2023 Introduction Ransomware, a malicious software that encrypts valuable data and demands a ransom for its release, has a notorious history marked by its evolution fro...

AppDomain Manager Injection: New Techniques For Red Teams

AppDomain Manager Injection is a very versatile and useful technique for red team operators. This technique allows you to effectively turn any Microsoft.NET application on a Windows host into a lolbin Living Off the Land Binary by forcing the application to load a specially crafted .NET assembly,...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

Privilege escalation

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

CVE-2022-37025

CVE-2022-37025 affects McAfee Security Scan Plus (MSS+) prior to 4.1.262.1. The vulnerability is described as improper privilege management that could let a local user modify a configuration file and perform a LOLBin (Living off the Land) attack, enabling elevated permissions and potential arbitr...

CVE-2022-1823

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

CVE-2022-1823

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

Privilege escalation

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

CVE-2022-1823 McAfee MCPR privilege escalation

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

CVE-2022-1823

The CVE-2022-1823 issue affects McAfee Consumer Product Removal Tool (MCPR) prior to version 10.4.128. Root cause: improper privilege management allows a local user to modify the MCPR configuration file, enabling a LOLBin-based attack and elevation of privileges to execute arbitrary code. Impact:...

Hackers Gain Fileless Persistence on Targeted SQL Servers Using a Built-in Utility

Microsoft on Tuesday warned that it recently spotted a malicious campaign targeting SQL Servers that leverages a built-in PowerShell binary to achieve persistence on compromised systems. The intrusions, which leverage brute-force attacks as an initial compromise vector, stand out for their use of...

Cybercriminals Swarm Windows Utility Regsvr32 to Spread Malware

A Windows living-off-the-land binary LOLBin known as Regsvr32 is seeing a big uptick in abuse of late, researchers are warning, mainly spreading trojans like Lokibot and Qbot. LOLBins are legitimate, native utilities used daily in various computing environments, that cybercriminals use to evade...

Slackor - A Golang Implant That Uses Slack As A Command And Control Server

A Golang implant that uses Slack as a command and control channel. This project was inspired by Gcat and Twittor. This tool is released as a proof of concept. Be sure to read and understand the Slack App Developer Policy before creating any Slack apps. Setup Note: The server is written in Python ...

LOLBAS - Living Off The Land Binaries And Scripts (LOLBins And LOLScripts)

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team ov...