LOLSpoof

LOLSpoof LOLSpoof 是一个交互式 shell 程序，能够自动伪造所生成进程的命令行参数。 只需调用看起来可疑的命令行 LOLBin（例如 powershell -w hidden -enc ZwBlAHQALQBwAHIAbwBjAGUA....），LOLSpoof 就会确保进程创建遥测看起来合法且清晰。 仅适用于 64 位 LOLBins 为什么 进程命令行是一种被高度监控的遥测数据，会被防病毒/EDR、SOC 分析师或威胁猎手仔细检查。 如何工作 1. 根据真实命令行构造伪造的命令行：lolbin.exe " " sizeofreal arguments 2...

LOLBAS

Binarios y Scripts y ahora también Librerías para Vivir de la Tierra Todos los archivos diferentes se pueden encontrar detrás de una interfaz elegante aquí: https://lolbas-project.github.io gracias a @ConsciousHacker por este adorno visual y al equipo de https://gtfobins.github.io/. Este...

UltimateWDACBypassList

Ultimate WDAC Bypass List A centralized resource for previously documented WDAC/Device Guard/UMCI bypass techniques as well for building/managing/testing WDAC policies Note: WDAC Windows Defender Application Control has been rebranded by Microsoft as "Application Control" or "Application Control...

Threat-Hunting

Caza de Amenazas | Ingeniería de Detección Colección de consultas de caza de amenazas y detección para: CrowdStrike Falcon usando CQL – CrowdStrike Query Language Microsoft Defender XDR usando KQL – Kusto Query Language Diseñado para detectar procesos sospechosos, comportamientos de red anómalos,...

lolbin-poc

lolbin-poc Pequeño PoC de uso de un ejecutable firmado por Microsoft como lolbin. Compilación 32-bit root@kitploit: cmake -B build32 -A Win32 cmake --build build32 --config Release Compilación 64-bit root@kitploit: cmake -B build64 -A x64 cmake --build build64 --config Release Uso Descarga WinDbg...

Decoding the DNA of Ransomware Attacks: Unveiling the Anatomy Behind the Threat

Decoding the DNA of Ransomware Attacks: Unveiling the Anatomy Behind the Threat By Trellix Advanced Research Center · August 28, 2023 Introduction Ransomware, a malicious software that encrypts valuable data and demands a ransom for its release, has a notorious history marked by its evolution fro...

AppDomain Manager Injection: New Techniques For Red Teams

AppDomain Manager Injection is a very versatile and useful technique for red team operators. This technique allows you to effectively turn any Microsoft.NET application on a Windows host into a lolbin Living Off the Land Binary by forcing the application to load a specially crafted .NET assembly,...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

Privilege escalation

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

CVE-2022-37025

CVE-2022-37025 affects McAfee Security Scan Plus (MSS+) prior to 4.1.262.1. The vulnerability is described as improper privilege management that could let a local user modify a configuration file and perform a LOLBin (Living off the Land) attack, enabling elevated permissions and potential arbitr...

CVE-2022-1823

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

CVE-2022-1823

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

Privilege escalation

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

CVE-2022-1823

The CVE-2022-1823 issue affects McAfee Consumer Product Removal Tool (MCPR) prior to version 10.4.128. Root cause: improper privilege management allows a local user to modify the MCPR configuration file, enabling a LOLBin-based attack and elevation of privileges to execute arbitrary code. Impact:...

CVE-2022-1823 McAfee MCPR privilege escalation

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

Hackers Gain Fileless Persistence on Targeted SQL Servers Using a Built-in Utility

Microsoft on Tuesday warned that it recently spotted a malicious campaign targeting SQL Servers that leverages a built-in PowerShell binary to achieve persistence on compromised systems. The intrusions, which leverage brute-force attacks as an initial compromise vector, stand out for their use of...

Cybercriminals Swarm Windows Utility Regsvr32 to Spread Malware

A Windows living-off-the-land binary LOLBin known as Regsvr32 is seeing a big uptick in abuse of late, researchers are warning, mainly spreading trojans like Lokibot and Qbot. LOLBins are legitimate, native utilities used daily in various computing environments, that cybercriminals use to evade...

Slackor - A Golang Implant That Uses Slack As A Command And Control Server

A Golang implant that uses Slack as a command and control channel. This project was inspired by Gcat and Twittor. This tool is released as a proof of concept. Be sure to read and understand the Slack App Developer Policy before creating any Slack apps. Setup Note: The server is written in Python ...

LOLBAS - Living Off The Land Binaries And Scripts (LOLBins And LOLScripts)

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team ov...