Multiple Botnets Exploiting Critical Oracle WebLogic Bug — PATCH NOW

Multiple botnets are targeting thousands of publicly exposed and still unpatched Oracle WebLogic servers to deploy crypto miners and steal sensitive information from infected systems. The attacks are taking aim at a recently patched WebLogic Server vulnerability, which was released by Oracle as...

CVE

This is a collection of HTML files from a blog about reverse engineering and security. The files are dated from August 2019 to September 2019 and appear to be written in Chinese. The content includes various topics such as: Creating and finding SEH Structured Exception Handler in Windows Input...

Elastic: Async search stores authorization headers in clear text

Summary: The .async-search index stores the results of async searches. It also stores a copy of the requests authorization headers, in clear text. These clear text authorization headers are then available to anyone with access to .async-search, probably mostly super users. Description: While you...

Countering a Home Invasion: Modernizing Threat Hunting Best Practices

The recently released VMware Carbon Black Global Incident Threat Report found that incidents of counter incident response IR are occurring in 82 percent of IR engagements. Counter IR involves several tactics, which include: disabling anti-malware scan interface, clearing/deleting logs, using...

Adaz - Automatically Deploy Customizable Active Directory Labs In Azure

This project allows you to easily spin up Active Directory labs in Azure with domain-joined workstations, Windows Event Forwarding, Kibana, and Sysmon using Terraform/Ansible. It exposes a high-level configuration file for your domain to allow you to customize users, groups and workstations...

North Korea-Backed Spy Group Poses as Reporters in Spearphishing Attacks, Feds Warn

The North Korean advanced persistent threat APT group known as Kimsuky is actively attacking commercial-sector businesses, often by posing as South Korean reporters, according to an alert from the U.S. Cybersecurity and Infrastructure Security Agency CISA. Kimsuky a.k.a. Hidden Cobra has been...

Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT&CK® framework. See the ATT &CK for Enterprise framework for all referenced threat actor techniques and mitigations. This Alert provides an update to Cybersecurity and Infrastructure Security...

Awesome-Red-Teaming

This is a list of resources for Red Teaming, a list that will be updated regularly with the latest adversarial tactics and techniques based on the Mitre ATT&CK framework. The list covers various topics such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credenti...

Crossing the Narrow Sea

Tom Kellermann, Head of Cybersecurity Strategy at VMware and Member of the Cyber Investigations Advisory Board of the United States Secret Service. “The Greatest trick the devil ever pulled was to convince the world he didn’t exist.” -Keyser Sose Cyberspace is not a pacific environment. According...

Acronis: Possible LDAP username and password disclosed on Github

Summary The file hosted at https://github.com/mlanin/go/blob/3dbd856c3f542c54e512a295ac498c79cd952ed6/.env.testing contains the following information: LDAPDOMAIN=███ LDAPBASEDN=███ LDAPADMINUSER=███████ LDAPADMINPASSWORD=██████ Recommendations Verify if credentials are still in use if so remove t...

Insecure RDP

There are active attack campaigns as of October 2020 targeting RDP servers without multi-factor authentication enabled. Recent assessments: zeroSteiner at October 09, 2020 6:36pm UTC reported: Over the past couple of years 2018-2020 attacks against RDP have become more and more common. Recent...

Industrial Cyberattacks Get Rarer but More Complex

Cyberattacks against the oil and gas industry inched up only slightly compared to the second half of 2019. Security experts say they are encouraged by the anemic growth, but at the same time are expressing concern that attacks are now becoming more potent, targeted and complex. According to new...

WMIHACKER - A Bypass Anti-virus Software Lateral Movement Command Execution Tool

中文版Chinese version Disclaimer: The technology involved in this project is only for security learning and defense purposes, illegal use is prohibited! Bypass anti-virus software lateral movement command execution test tool（No need 445 Port） Introduction: The common WMIEXEC, PSEXEC tool execution...

VMware Carbon Black First to Block Hidden Malicious Commands in Obfuscated Scripts

For a long time now, our Threat Analysts have flagged the growing threat of script-based attacks, especially from Microsoft PowerShell and Windows Management Interface script commands, and their ability to escape notice in many antivirus solutions. Increasingly, these types of attacks have become...

Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

When attackers successfully breach a target network, their typical next step is to perform reconnaissance of the network, elevate their privileges, and move laterally to reach specific machines or spread as widely as possible. For these activities, attackers often probe the affected network’s...

UPDATE: PoshC2 v6.0

PoshC2 v6.0 was released a couple of months ago which includes a number of significant and exciting features. Additionally it contains a lot of bug fixes and small improvements as well! What is PoshC2? PoshC2 is a proxy aware C2 framework in Python3, used to aid penetration testers with red...

COOKIEJAR: Tracking Adversaries With FireEye Endpoint Security’s Logon Tracker Module

During a recent investigation at a telecommunications company led by Mandiant Managed Defense, our team was tasked with rapidly identifying systems that had been accessed by a threat actor using legitimate, but compromised domain credentials. This sometimes-challenging task was made simple becaus...

Chalumeau - Automated, Extendable And Customizable Credential Dumping Tool

Chalumeau is automated,extendable and customizable credential dumping tool based on powershell and python. Main Features Write your own Payloads In-Memory execution Extract Password List Dashboard reporting / Web Interface Parsing Mimikatz Dumping Tickets Screenshots Known Issues Parsing Mimikatz...

Black Hat USA 2020: VMware Carbon Black Releases Global Incident Response Threat Report Detailing Surge in Cyberattacks Amid COVID-19

At Black Hat USA this week, VMware Carbon Black unveils findings from the fifth installment of the semiannual Global Incident Response Threat Report, entitled: “COVID-19 Continues to Create a Larger Surface Area for Cyberattacks,” based on an online survey in April 2020 of forty-nine incident...

Lateral Movement – Services

Services with elevated privileges typically were used in the past as method of privilege escalation or persistence. However a service could be utilized for lateral… Continue reading - Lateral Movement - Services...