CVE-2021-1675_RDL_LPE

CVE-2021-1675RDLLPE PrintNightMare LPE 권한 상승 취약점을 위한 CS 반사 로딩 플러그인입니다. 바로 사용할 수 있으며, 메모리 로딩과 난독화된 드라이버 이름 로딩을 통해 Defender/EDR을 우회합니다. 면책 조항: 이 프로젝트는 학습 및 교류 목적으로만 제공되며, 합리적인 승인 범위 내에서 주의하여 사용하시기 바랍니다. 빠른 사용 이 프로젝트 다운로드: Cobalt Strike 플러그인 로드 사용법: printnightmarelpe dllpath elevate -...

MemTracer - Memory Scaner

MemTracer is a tool that offers live memory analysis capabilities, allowing digital forensic practitioners to discover and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework Dynamic-Link...

Windows Defender Advanced Threat Protection で反射型の DLL 読み込みを検出

本記事は、Windows Security のブログ “Detecting reflective DLL loading with Windows Defender ATP” 2017 年 11 月 13 日 米国時間公開...

Detecting reflective DLL loading with Windows Defender ATP

Today's attacks put emphasis on leaving little, if any, forensic evidence to maintain stealth and achieve persistence. Attackers use methods that allow exploits to stay resident within an exploited process or migrate to a long-lived process without ever creating or relying on a file on disk. In...

Detecting reflective DLL loading with Windows Defender ATP

Today's attacks put emphasis on leaving little, if any, forensic evidence to maintain stealth and achieve persistence. Attackers use methods that allow exploits to stay resident within an exploited process or migrate to a long-lived process without ever creating or relying on a file on disk. In...