herpaderping

Process Herpaderping Process Herpaderping は、イメージがマッピングされた後にディスク上のコンテンツを変更することで、プロセスの意図を隠蔽する手法です。これにより、セキュリティ製品やOS自体に興味深い動作が発生します。 概要...

Ekko

Ekko 一种使用 CreateTimerQueueTimer Win32 API 的小型睡眠混淆技术。 概念验证。可以做得更好。 注意 此实现存在已知缺陷。 因此，我不建议在不了解其工作原理或不知道如何发现和修复这些缺陷的情况下使用它。 TLDR：不要将其复制粘贴到你的植入体中。 致谢 Austin Hudson @SecIdiot https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html 最初由 Peter Winter-Smith 发现，并被用于 MDSec 的 Nighthawk...

New Mockingjay Process Injection Technique Could Let Malware Evade Detection

A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. "The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers...

Hackers Using Trojanized macOS Apps to Deploy Evasive Cryptocurrency Mining Malware

Trojanized versions of legitimate applications are being used to deploy evasive cryptocurrency mining malware on macOS systems. Jamf Threat Labs, which made the discovery, said the XMRig coin miner was executed by means of an unauthorized modification in Final Cut Pro, a video editing software fr...

WinAPI User Hunter: hunter

WinAPI User Hunter During Red Team engagements it is common to track/hunt specific users. Assuming we already have access to a desktop as a normal user no matter how, always “assume compromise” in a Windows Domain and we want to spread laterally. We want to know where the user is logged on, if he...