19 matches found
EtwSessionHijacking
EtwSessionHijacking : un PoC sur le blocage de Procmon pour l'empêcher de surveiller les événements réseau Démo : https://user-images.githubusercontent.com/111295429/186082150-32ed304b-ba45-42a4-8baa-37dd75246c68.mp4 Basé sur : Problèmes de conception des EDR modernes : contourner les solutions...
Noriben
صندوق رمل تحليل البرامج الضارة Noriben root@kitploit: معلومات الاتصال: @bbaskin على تويتر brian at thebaskins dot com Noriben هو نص برمجي مبني على بايثون يعمل مع Sysinternals Procmon لجمع وتحليل وإعداد تقارير حول مؤشرات وقت التشغيل للبرامج الضارة تلقائيًا. باختصار، يسمح لك بتشغيل تطبيق، والضغط عل...
ImpulsiveDLLHijack
ImpulsiveDLLHijack أداة مبنية بلغة C تعمل على أتمتة عملية اكتشاف واستغلال اختطاف DLL في الملفات الثنائية المستهدفة. يمكن لاحقًا استخدام المسارات المختطفة المكتشفة أثناء عمليات الفريق الأحمر لتجاوز أنظمة كشف التهديدات EDR. 1. المنهجية: تقوم الأداة بشكل أساسي بأتمتة المراحل التالية التي يتم إجراؤها...
Anvil
Windows thick 클라이언트를 위한 런타임 우선 권한 상승 및 공격 표면 평가. Anvil은 Windows thick 클라이언트 애플리케이션을 위한 런타임 우선 권한 상승 및 공격 표면 평가 도구입니다. 파일 시스템을 맹목적으로 스캔하는 대신, Procmon 캡처와 Windows AccessCheck 를 결합하여 런타임에 관찰되고 표준 사용자에게 쓰기 가능 한 경로만 보고함으로써, 일반적인 열거 도구에서 발생하는 거짓 긍정 소음을 제거합니다. 목차 주요 기능 작동 방식 모듈 요구 사항 Sysinternals 도구 설치 ...
Spartacus
!CAUTION هذا المستودع غير مُدار، قم بزيارة https://github.com/sadreck/Spartacus للحصول على أحدث إصدار. مجموعة أدوات اختطاف DLL/COM من Spartacus لماذا "Spartacus"؟ إذا شاهدت فيلم Spartacus من عام 1960، ستتذكر المشهد حيث يطلب الرومان من Spartacus تسليم نفسه. في اللحظة التي وقف فيها Spartacus الحقيق...
fingerprint
fingerprint Surveillance des modifications du registre et des fichiers sous Windows - analyse forensique du registre et des fichiers Windows "fingerprint" enregistre l'état d'un système Windows en termes de fichiers et de registre. Ces empreintes peuvent être comparées pour trouver toutes les...
VISION-ProcMon
À propos VISION-ProcMon est un outil dédié à l'analyse de malwares et plus précisément à l'analyse comportementale. VISION-ProcMon combine les technologies Rust et web afin de fournir une visualisation rapide et améliorée du comportement d'un malware après avoir capturé son activité avec l'outil...
Canadian Furious Beaver - A Tool For Monitoring IRP Handler In Windows Drivers, And Facilitating The Process Of Analyzing, Replaying And Fuzzing Windows Drivers For Vulnerabilities
Furious Beaver is a distributed tool for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the "Broker" combines both a user-land agent and a self-extractable driver IrpDumper.sys that will install itself on the targeted system. Once running it will expose depending on the...
ImpulsiveDLLHijack - C# Based Tool Which Automates The Process Of Discovering And Exploiting DLL Hijacks In Target Binaries
C based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during RedTeam Operations to evade EDR's. 1. Methodological Approach : The tool basically acts on automating following stages performed for...
Acronis: Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 - Acronis Scheduler2 Service
Vulnerability description not provided...
Acronis: Arbitrary DLL injection in mmsminisrv (Acronis Managed Machine Service Mini)
During initialization, mmsmini.exe service binary of mmsminisrv loads library C:\Program Files x86\Common Files\Acronis\Home\libssl10.dll. The library then tries to load non-existing file: C:\bshudson\workspace\mod-openssl-fips-win\205\product\out\standard\vs2013release\OpenSSL\ssl\openssl.cnf. T...
Microsoft Windows 10 (17763.379) - Install DLL
Microsoft Windows 10 17763.379 - Install DLL edit: Figure out how this works for yourself. I can't be bothered. It's a really hard race, doubt anyone will be able to repro anyway. Could be used with malware, you could programmatically trigger the rollback. Maybe you can even pass the silent flag ...
Setting ProcMon to run at a lower altitude to capture other filter drivers
If you need to get Procmon's filter to run below us in the filter stack, it has a setting for that. Procmon is usually used to figure out what is happening on the machine, but you do not get to see the activity of things such as virus scanners and unifiltr because they happen at a lower level tha...
Visual Malware Analysis: ProcDOT
Visual Malware Analysis There are plenty of tools for behavioral malware analysis. The defacto standard ones, though, are Sysinternals’s Process Monitor also known as Procmon and PCAP generating network sniffers like Windump, Tcpdump, Wireshark, and the like. These “two” tools cover almost...
Portable Malware Analysis Sandbox: Noriben
Portable Malware Analysis Sandbox Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of...
Noriben - Portable, Simple, Malware Analysis Sandbox
Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...
Noriben - Your Personal, Portable Malware Sandbox
Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...
Google Chrome Browser (ChromeHTML://) Remote Parameter Injection
No description provided by source. !-- Google Chrome Browser ChromeHTML:// remote parameter injection POC by Nine:Situations:Group::bellick&strawdog Site: http://retrogod.altervista.org/ tested against: Internet Explorer 8 beta 2, Google Chrome 1.0.154.36, Microsoft Windows XP SP3 List of command...