53 matches found
cobaltstrike-sleepmask-yara
cobaltstrike-sleepmask-yara Just a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs tl;dr The tl;dr of it is that these bytes are part of the sleep mask kit unobfuscated .text section itsel...
SeeProxy
SeeProxy Golang reverse proxy with CobaltStrike malleable profile validation. The premise of this tool is to not open your teamserver to the world but to a single instance of SeeProxy instead. This way every request reaching your teamserver is a legitimate C2 traffic. Example deployment Below you...
MemFiles
MemFiles DISCLAIMER: This project is complex and failure to understand how it works and adequately test it can result in you crashing Beacons and losing access! I highly encourage you to read all of the documentation up until the "Technical Details, Design Considerations, and Commentary" section!...
CoercedPotatoRDLL
Coerced Potato Reflective DLL Privilege escalation from NT Service to SYSTEM using SeImpersonateToken privilege and MS-RPRN functions. Heavily based on https://github.com/Prepouce/CoercedPotato Reflective Loader from https://github.com/stephenfewer/ReflectiveDLLInjection. Install Clone this repo...
volatility
This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3 ============================================================================ Volatility Framework - Volatile memory extraction utility framework The Volatility Framework is a...
RedWarden
RedWarden - Flexible CobaltStrike Malleable Redirector previously known as proxy2's malleableredirector plugin Let's raise the bar in C2 redirectors IR resiliency, shall we? Red Teaming business has seen several different great ideas on how to combat incident responders and misdirect them while...
CVE-2026-94114
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...
CVE-2022-23317
CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...
EUVD-2022-28399
Malicious code in bioql PyPI...
Exploit for Link Following in Microsoft
CVE-2023-36874 Windows Error Reporting LPE BOF Introductio...
Rheinmetall attacked by BlackBasta ransomware
On Friday May 19, 2023, the German arms producer Rheinmetall acknowledged a cyber-incident at one of its subsidiaries in the private sector. The BlackBasta ransomware group has already claimed responsibility for the attack through its leak-site. Entry for Rheinmetall on BlackBasta leak site...
Sandman - NTP Based Backdoor For Red Team Engagements In Hardened Networks
Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many defenders...
TrickBot Gang Shifted its Focus on "Systematically" Targeting Ukraine
In what's being described as an "unprecedented" twist, the operators of the TrickBot malware have resorted to systematically targeting Ukraine since the onset of the war in late February 2022. The group is believed to have orchestrated at least six phishing campaigns aimed at targets that align...
NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit
ByCas van Cooten @chvancooten With special thanks to Marcello Salvati @byt3bl33der and Fabian Mosch @S3cur3Th1sSh1t Description Update: NimPackt-v1 is among the worst code I have ever written I was just starting out learning Nim. Because of this, I started on a full rewrite of NimPackt, dubbed...
CobaltBus - Cobalt Strike External C2 Integration With Azure Servicebus, C2 Traffic Via Azure Servicebus
Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus Setup 1. Create an Azure Service Bus 2. Create a Shared access policy Connection string that can only Send and Listen 3. Edit the static connectionString variable in Beacon C projects to match the "Primar...
New UAC-0056 activity: There’s a Go Elephant in the room
This blog post was authored by Ankur Saini, Roberto Santos and Hossein Jazi. UAC-0056 also known as SaintBear, UNC2589 and TA471 is a cyber espionage actor that has been active since early 2021 and has mainly targeted Ukraine and Georgia. The group is known to have performed a wiper attack in...
CVE-2022-23317
CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...
Design/Logic Flaw
CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...
CVE-2022-23317
CVE-2022-23317 concerns the Cobalt Strike HTTP(S) listener. The root cause is that the listener fails to determine whether the request URL begins with a “/”, allowing an attacker to obtain information by crafting the URL. Affected: Cobalt Strike versions
