Registry-Recon

Registry-Recon 执行系统/AV/EDR 侦察的 Cobalt Strike Aggressor 脚本。 作者：Jess Hires 描述 作为红队实践者，我们经常使用工具来尝试识别受感染系统的详细信息，并且尽可能以最隐蔽的方式进行。由于使用了 Windows CLI 命令，我们常用的一些工具开始被 EDR 产品标记。本 aggressor 脚本旨在通过仅使用原生注册表查询（不使用 CLI 命令）来探测系统，从而解决该问题。 设置 只需通过脚本管理器将 reg.cna 加载到 Cobalt Strike 中。然后右键单击要执行注册表侦察的 beacon，选择...

AggressorScripts - Collection Of Aggressor Scripts For Cobalt Strike 3.0+ Pulled From Multiple Sources

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources: AllInOne.cna v1 - Removed and outdated All purpose script to enhance the user's experience with cobaltstrike. Custom menu creation, Logging, Persistence, Enumeration, and 3rd party script integration. Version 2 i...

Latest Windows UAC Bypass Permits Code Execution

Less than a month after disclosing a Windows User Account Control bypass, researcher Matt Nelson today published another attack that circumvents the security feature and leaves no traces on the hard disk. This time, the bypass relies on Event Viewer eventvwr.exe, a native Windows feature used to...