CredPhish - A PowerShell Script Designed To Invoke Legitimate Credential Prompts And Exfiltrate Passwords Over DNS

CredPhish is a PowerShell script designed to invoke credential prompts and exfiltrate passwords. It relies on CredentialPicker to collect user passwords, Resolve-DnsName for DNS exfiltration, and Windows Defender's ConfigSecurityPolicy.exe to perform arbitrary GET requests. For a walkthrough, see...

Combing through the fuzz: Using fuzzy hashing and deep learning to counter malware detection evasion techniques

Today’s cybersecurity threats continue to find ways to fly and stay under the radar. Cybercriminals use polymorphic malware because a slight change in the binary code or script could allow the said threats to avoid detection by traditional antivirus software. Threat actors customize their wares...

Combing through the fuzz: Using fuzzy hashing and deep learning to counter malware detection evasion techniques

Today’s cybersecurity threats continue to find ways to fly and stay under the radar. Cybercriminals use polymorphic malware because a slight change in the binary code or script could allow the said threats to avoid detection by traditional antivirus software. Threat actors customize their wares...

Windows Defender update caught removing zip, exe, source code files

By Waqas The Windows Defender daily update flagged DeCSS DVD encryption software copy as a Trojan and quarantined it before deleting it. This is a post from HackRead.com Read the original post: Windows Defender update caught removing zip, exe, source code files...

This New Malware Hides Itself Among Windows Defender Exclusions to Evade Detection

Cybersecurity researchers on Tuesday lifted the lid on a previously undocumented malware strain dubbed "MosaicLoader" that singles out individuals searching for cracked software as part of a global campaign. "The attackers behind MosaicLoader created a piece of malware that can deliver any payloa...

“Seven or eight” zero-days: The failed race to fix Kaseya VSA, with Victor Gevers, Lock and Code S02E13

Kaseya VSA included at least “seven or eight” privately known zero-day vulnerabilities before it suffered a widespread ransomware attack that impacted hundreds of businesses, said Victor Gevers, chair of the Dutch Institute for Vulnerability Disclosure, or DIVD, a volunteer-run organization that...

redpill

This is a PowerShell module repository called "redpill" that provides various post-exploitation tools for Windows systems. The repository contains several scripts that can be used to perform different tasks such as: Bypassing AppLocker restrictions Hijacking browser cookies Downloading and...

CVE-2021-34464

Microsoft Defender Remote Code Execution Vulnerability...

CVE-2021-34464

Microsoft Defender Remote Code Execution Vulnerability...

Remote code execution

Microsoft Defender Remote Code Execution Vulnerability...

CVE-2021-34464 Microsoft Defender Remote Code Execution Vulnerability

...

CVE-2021-34464

CVE-2021-34464 affects the Microsoft Windows Defender Malware Protection Engine (Windows Defender) and is a remote code execution vulnerability in that engine. The OpenVAS/Nessus entries describe multiple RCE vulnerabilities in the Defender/Malware Protection Engine, with exploitation leading to ...

Security Update for Windows Defender (July 2021)

The Malware Protection Engine version of Microsoft Windows Defender installed on the remote Windows host is prior to 1.1.18242.0. It is, therefore, affected by multiple remote code execution vulnerabilities. An attacker can exploit one of these vulnerabilities to bypass authentication and execute...

CVE-2021-34522

Microsoft Defender Remote Code Execution Vulnerability...

CVE-2021-34522

Microsoft Defender Remote Code Execution Vulnerability...

Remote code execution

Microsoft Defender Remote Code Execution Vulnerability...

CVE-2021-34522

CVE-2021-34522 is a Microsoft Defender vulnerability in the Microsoft Malware Protection Engine used by Windows Defender. Reports describe it as a Remote Code Execution issue with a local attack vector and high impact on confidentiality, integrity, and availability. Exploitation is conditioned on...

CVE-2021-34522 Microsoft Defender Remote Code Execution Vulnerability

...

Microsoft delivers comprehensive solution to battle rise in consent phishing emails

Microsoft threat analysts are tracking a continued increase in consent phishing emails, also called illicit consent grants, that abuse OAuth request links in an attempt to trick recipients into granting attacker-owned apps permissions to access sensitive data. This blog offers a look into the...

Microsoft delivers comprehensive solution to battle rise in consent phishing emails

Microsoft threat analysts are tracking a continued increase in consent phishing emails, also called illicit consent grants, that abuse OAuth request links in an attempt to trick recipients into granting attacker-owned apps permissions to access sensitive data. This blog offers a look into the...