19 matches found
certificate-of-compromise
妥协证书 针对 Active Directory 证书服务攻击操作的系统化知识/白皮书 v1.0.0 活文档与社区贡献 本文档是一份活文档。ADCS 研究并非一成不变——技术会被修补，新条件会被发现，社区分析会不断修正对现有技术的理解。随着这些变化，本文档将更新：添加新技术，修订补丁状态条目，在存在更佳信号时纠正检测指南。版本历史记录在仓库中。 如果您发现任何错误——技术性的、事实性的，或排版错误——请报告。如此规模的文章中出现错误是不可避免的。请提交 issue 或发起讨论。 欢迎提交修正的拉取请求。如需直接联系，本文档前页提供了联系邮箱，或通过 X 联系...
mal_unpack
malunpack Dynamic unpacker based on PE-sieve 📖 Read more . It deploys a packed malware, waits for it to unpack the payload, dumps the payload, and kills the original process. !CAUTION This unpacker deploys the original malware. Use it only on a VirtualMachine. ⚙ Usage Basic usage: malunpack.exe...
Veil-PowerView
PowerTools Veil 的 PowerTools 是一系列专注于攻击性操作的 PowerShell 项目。 由 @harmj0y 和 @sixdub 开发。...
OffensiveNim
OffensiveNim 这是我使用Nim开发implant植入体和常用的攻击作战工具的实验。 目录 OffensiveNim 为什么用Nim 使用范例 范例中的半成品 编译范例 跨平台编译 C/C++接口 用DllMain入口点函数创建Windows DLLs 优化可执行程序大小 是否使用Winim库，可执行程序大小是不同的 Opsec考虑 转换C代码去Nim 跨语言使用 调试 配置开发环境 我遇到过的陷阱 有趣的Nim库 Nim植入体开发相关连接 为什么用Nim 直接编译成 C, C++, Objective-C 和 Javascript。...
Ps-Tools
Ps-Tools，一款用于进攻性行动的高级进程监控工具包。 在对目标进行行动期间，深入了解所进入系统的技术细节是决定下一步关键行动的关键条件。从受感染系统收集并分析正在运行的进程数据，能为我们提供丰富的信息，有助于更好地理解目标组织的IT架构。此外，定期轮询进程数据使我们能够对环境变化做出反应，或侦测到调查活动正在进行中时的触发信号。 为了能够从受感染的终端收集详细的进程数据，我们编写了一套进程工具，将这些高级进程实用工具的功能引入C2框架（如Cobalt Strike）。 有关工具及所用技术的更多信息，请参见以下博客：...
redhound-arsenal
Red Hound Arsenal Agent-consumable security skill library for...
SideWinder’s Nim Backdoor Spells Trouble for South Asian Nations
Summary: SideWinder, also known as Razor Tiger, commenced its offensive operations in 2012 and has recently shifted its focus to targeting Bhutan. It employs deceptive content, ultimately executing the Nim Backdoor. The decoy content utilized in the sample is directly sourced from announcements...
OffensiveNotion - Notion As A Platform For Offensive Operations
Notion yes, the notetaking app as a C2. Wait, What? Yes. But Why? What started as a meme grew into a full project. Just roll with it. Read more! Here's our blog post about it: We Put A C2 In Your Notetaking App: OffensiveNotion Features A full-featured C2 platform built on the Notion notetaking...
2022 Threat Predictions
Trellix 2022 Threat Predictions By Trellix · January 19, 2022 Ransomware, nation states, social media, and a shifting reliance on a remote workforce made headlines in 2021, proving that bad actors only continue to rise to the challenge. Defiantly, they thwart solution stacks and gain momentum eac...
Domain Persistence – AdminSDHolder
Utilizing existing Microsoft features for offensive operations is very common during red team assessments as it provides the opportunity to blend in with the environment… Continue reading - Domain Persistence - AdminSDHolder...
Domain Persistence – AdminSDHolder
Utilizing existing Microsoft features for offensive operations is very common during red team assessments as it provides the opportunity to blend in with the environment… Continue reading - Domain Persistence - AdminSDHolder...
DarkLoadLibrary - LoadLibrary For Offensive Operations
LoadLibrary for offensive operations. How does is work? https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/ Usage DARKMODULE DarkModule = DarkLoadLibrary LOADLOCALFILE, // control flags L"TestDLL.dll", // local dll path, if loading from disk NULL, // DLL Buffer to load from if...
Potential for Iranian Cyber Response to U.S. Military Strike in Baghdad
Summary The Cybersecurity and Infrastructure Security Agency CISA is sharing the following information with the cybersecurity community as a primer for assisting in the protection of our Nation’s critical infrastructure in light of the current tensions between the Islamic Republic of Iran and the...
Ps-Tools - An Advanced Process Monitoring Toolkit For Offensive Operations
Having a good technical understanding of the systems we land on during an engagement is a key condition for deciding what is going to be the next step within an operation. Collecting and analysing data of running processes from compromised systems gives us a wealth of information and helps us to...
The NSA, Snowden and the Internet's Offensive Future
Despite everything that has transpired in the last year, Edward Snowden sounded calm, reflective and in some ways wistful yesterday discussing the fallout and consequences of the multitude of NSA programs and methods he’s revealed. Snowden bemoaned the fact that the NSA specifically and the...
Air Force Classifies Some Cybersecurity Tools as Weapons
The United States government for years has been developing and deploying offensive cyber capabilities, most of it done without much in the way of public notice. That’s been changing of late, as government and military officials have become more open in discussing these capabilities and under what...
U.S. Cyberwar Doctrine Would Not Matter Without International Agreement
When the history of cyberwar is written, 2012 may well be marked down as the year that it all began in earnest. Governments have been attacking one another electronically for decades now, but the last 12 months have seen both the concept and reality of cyberwar elbow their way into the...
US military's offensive operations in cyberspace to shoot Hackers
US military's offensive operations in cyberspace to shoot Hackers The US military is now legally in the clear to launch offensive operations in cyberspace, the commander of the US Strategic Command has said. The Pentagon has just sent a report to Congress where it says that it has the right to...
HOLD — HBGary Federal News…
HBGary Federal, the beleagured security startup that has been the target of the online mischief making group Anonymous for the last week said on Monday that it was ceasing operations | its CEO Aaron Barr was stepping down. The consulting firm, a wholly owned subsidiary of HBGary Inc., had been...