vulnerable-AD

Vulnerable-AD ローカルラボでActive Directoryのほとんどの攻撃をテストできる脆弱なActive Directoryを作成します 主な機能 攻撃のランダム化 言及された攻撃の全カバレッジ スクリプトをActive DirectoryがインストールされたDCで実行する必要があります 一部の攻撃にはクライアントワークステーションが必要です 対応している攻撃 ACL/ACEの悪用 Kerberoasting AS-REP Roasting DnsAdminsの悪用 オブジェクトの説明内のパスワード デフォルトパスワードを持つユーザーオブジェクト Changeme123...

GhostTask

Ghost Scheduled Task WithSecureによるスケジュールタスク改ざんの研究に着想を得て、レジストリキーの操作のみでスケジュールタスクを作成する可能性が説明されていました。このアプローチにより、4698や106といったスケジュールタスク作成イベントログの生成を回避でき、よりステルスな永続化手段が実現できます。これらの知見に基づき、私はレジストリの直接操作によるスケジュールタスク作成を実証するPOCを開発しました。...

NetNTLMtoSilverTicket

SpoolSample - NetNTLMv1 - NTLM - シルバーチケット この手法は他の人々によって示唆されてきましたが、まとまったものは見当たりませんでした。以下では、NetNTLMv1 チャレンジ/レスポンス認証を取得し、それを NTLM ハッシュにクラックし、その NTLM ハッシュを使用して Kerberos シルバーチケットに署名する手順を説明します。 この手法は、"LAN Manager 認証レベル"が 2 以下に設定されているネットワークで機能します。これは、古い大規模な Windows 環境ではかなり一般的なシナリオです。Windows 10 / Server...

Silver

このリポジトリには README がありません。...

blackhat-usa-2022-demos

blackhat-usa-2022-demos Blackhat USA 2022 演讲 "Taking Kerberos to the Next Level" 的演示。 这是 James Forshaw @tiraniddo 和 Nick Landers @monoxgas 的演讲幻灯片和演示。演示如下： demo1.ps1 - 使用密码的 Silver ticket。 demo2.ps1 - Silver ticket U2U。 demo3.ps1 - 带缓冲区类型混淆的 Silver ticket。 demo4.ps1 - KDC 固定与 BYOKDC demo5.ps1 -...

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions. Russian cybersecurity vendor Kaspersky...

Improving Interoperability among Defence and National Security Ontologies: Analysis and Evaluation Tasks

The use of ontologies and knowledge graphs is becoming increasingly widespread in the defence and national security domain. Numerous ontologies have been developed through initiatives led by academia, industry, and government. Achieving interoperability across diverse defence and national securit...

Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...

New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

The China-linked cybercrime group known as Silver Fox has been attributed to a new Rust-based remote access trojan RAR called MODBEACON. Chinese cybersecurity company QiAnXin said that while the threat cluster may appear like a low-sophistication, high-activity operation that propagates malware v...

ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagree

Agent skills extend AI agents with reusable instructions, tools, scripts, references, and workflows, establishing a security boundary distinct from both model safety and traditional package-malware detection. ClawHub Security Signals is a sanitized dataset of 67,453 latest public OpenClaw skill...

Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia

The China-based cybercrime group known as Silver Fox aka Monarch, SwimSnake, The Great Thief of Valley, UTG-Q-1000, and Void Arachne has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor. The activity involved using phishing emails that...

CVE-2026-20709

A flaw was found in some Intel Pentium Processor Silver Series, Intel Celeron Processor J Series, and Intel Celeron Processor N Series. This vulnerability arises from the use of a default cryptographic key in the hardware. A sophisticated attacker with physical access and privileged user access...

EUVD-2026-20538

Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...

CVE-2026-20709

Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...

CVE-2026-20709

Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...

CVE-2026-20709

This CVE (CVE-2026-20709) concerns the use of a default cryptographic key embedded in hardware on select Intel processors (Pentium Silver, Celeron J/N series). The root cause is a default key in hardware that could be exploited by a hardware reverse engineer with privileged access and high attack...

CVE-2026-20709

Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...