herpaderping

Process Herpaderping Process Herpaderping은 이미지가 매핑된 후 디스크의 콘텐츠를 수정하여 프로세스의 의도를 은폐하는 방법입니다. 이로 인해 보안 제품과 OS 자체에서 의아한 동작이 발생합니다. 요약 일반적으로 보안 제품은 Windows 커널에 콜백을 등록하여PsSetCreateProcessNotifyRoutineEx 프로세스 생성 시 조치를 취합니다. 이 시점에서 보안 제품은 실행 파일을 매핑하는 데 사용된 파일을 검사하고 이 프로세스의 실행을 허용할지 결정할 수 있습니다. 이 커널 콜백은...

Ekko

Ekko CreateTimerQueueTimer Win32 API を使用する小さなスリープ難読化テクニックです。 概念実証（PoC）です。より良い実装が可能です。 注記 この実装には既知の欠陥があります。 したがって、その仕組みを理解せずに、あるいは欠陥を発見・修正する方法を知らずに使用することはお勧めしません。 TLDR: 自分のインプラントにコピペしないでください。 クレジット Austin Hudson @SecIdiot https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html 元々は Peter...

New Mockingjay Process Injection Technique Could Let Malware Evade Detection

A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. "The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers...

Hackers Using Trojanized macOS Apps to Deploy Evasive Cryptocurrency Mining Malware

Trojanized versions of legitimate applications are being used to deploy evasive cryptocurrency mining malware on macOS systems. Jamf Threat Labs, which made the discovery, said the XMRig coin miner was executed by means of an unauthorized modification in Final Cut Pro, a video editing software fr...

WinAPI User Hunter: hunter

WinAPI User Hunter During Red Team engagements it is common to track/hunt specific users. Assuming we already have access to a desktop as a normal user no matter how, always “assume compromise” in a Windows Domain and we want to spread laterally. We want to know where the user is logged on, if he...