Invoke-PSObfuscation

Invoke-PSObfuscation 传统的混淆技术倾向于添加层来封装现有代码，例如 base64 或压缩。这些载荷仍然有一定程度的成功，但它们已经变得很容易提取预期的载荷，并且一些启动器经常被检测到，这本质上引入了瓶颈。 本工具引入的方法是一种方法论，你可以针对脚本的各个组件进行混淆，使用随机变化来实现相同的预期逻辑，而无需将整个载荷封装在单层中。由于混淆逻辑的复杂性，生成的载荷将很难被签名化，并且会绕过那些未编程为模拟继承逻辑的启发式引擎。...

MAL-2025-616 Malicious code in marked-at (npm)

This package contains a PowerShell download cradle to execute a Cobalt Strike beacon and establish command and control. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2adf9556402c124dc6a1146e6c3bb6a90efee66a9a0bbfdeb3188d4477099d2d Any computer that has this packag...

It’s Your Money and They Want It Now — The Cycle of Adversary Pursuit

When we discover new intrusions, we ask ourselves questions that will help us understand the totality of the activity set. How common is this activity? Is there anything unique or special about this malware or campaign? What is new and what is old in terms of TTPs or infrastructure? Is this being...

Brosec - An interactive reference tool to help security professionals utilize useful payloads and commands

Brosec is a terminal based reference utility designed to help us infosec bros and broettes with useful yet sometimes complex payloads and commands that are often used during work as infosec practitioners. An example of one of Brosec's most popular use cases is the ability to generate on the fly...