redsails

Redsails 概要 ポストエクスプロイテーションツールで、以下の機能を持ちます。 侵害したマシン上での永続性維持 多くの一般的なホストイベントログ（ネットワークおよびアカウントログオン）の回避 偽のログ・ネットワークトラフィックの生成 これは PyDivert https://github.com/ffalcinelli/pydivert に基づいています。PyDivert は WinDivert のPythonバインディングであり、WinDivert...

PortBender

개요 PortBender는 TCP 포트 리디렉션 유틸리티로서, 레드팀 운영자가 하나의 TCP 포트예: 445/TCP로 들어오는 트래픽을 다른 TCP 포트예: 8445/TCP로 리디렉션할 수 있도록 해줍니다. PortBender는 운영자가 Cobalt Strike와 도구를 통합할 수 있도록 하는 어그레서 스크립트를 포함합니다. 그러나 이 도구는 리플렉티브 DLL로 구현되어 있기 때문에 "ReflectiveLoader" 인터페이스1를 통해 모듈을 로드하는 모든 C2 프레임워크와 통합될 수 있습니다. 또한 이 도구는 운영자가 Duq...

SharpRelay

使用方法 この攻撃を機能させるための唯一の要件は、ローカル管理者 権限を持つビーコン、またはドライバをロードできるビーコンを持つことです。SharpRelayを使用した攻撃は以下のように動作します： 署名済み のWinDivertドライバを侵害されたホストの任意のフォルダにアップロードします。 SharpRelayを実行して、ポート445に着信するパケットの宛先ポートを変更し、別のポート（例：8445）にリダイレクトします。 ビーコンからCobalt Strikeのrportfwdコマンドを実行して、侵害されたホストのポート8445を自チームサーバーのポート445に転送します。...

EDRPrison

EDRPrison 共著者: @oops4githttps://github.com/oops4git EDRPrison は、正規の WFP コールアウトドライバである WinDivert を活用して、EDR システムを効果的に沈黙させます。Shutter、FireBlock、EDRSilencer などのツールから着想を得ており、このプロジェクトはネットワークベースの回避技術に焦点を当てています。先行ツールとは異なり、EDRPrison は組み込みの WFP のみに依存するのではなく、外部の正規 WFP コールアウトドライバをインストールして読み込みます。さらに、EDR...

Experts Discover Backdoor Deployed on the U.S. Federal Agency's Network

A U.S. federal government commission associated with international rights has been targeted by a backdoor that reportedly compromised its internal network in what the researchers described as a "classic APT-type operation." "This attack could have given total visibility of the network and complet...

PortBender - TCP Port Redirection Utility

PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port e.g., 445/TCP to another TCP port e.g., 8445/TCP. PortBender includes an aggressor script that operators can leverage to integrate the tool with Cobalt Strike. Howeve...

Divergent: "Fileless" NodeJS Malware Burrows Deep Within the Host

Update 09/27/2019: Additional information regarding the malware interaction with various online advertisements has been included to highlight the click-fraud related network communications associated with Divergent. Executive summary Cisco Talos recently discovered a new malware loader being used...

Microsoft Warns of a New Rare Fileless Malware Hijacking Windows Computers

Watch out Windows users! There's a new strain of malware making rounds on the Internet that has already infected thousands of computers worldwide and most likely, your antivirus program would not be able to detect it. Why? That's because, first, it's an advanced fileless malware and second, it...

Thousands of PCs Affected by Nodersok/Divergent Malware

New malware identified by Microsoft and Cisco Talos has affected thousands of PCs in the United States and Europe and turns systems into proxies for performing malicious activity, the companies said. The fileless threat—called Nodersok by Microsoft and Divergent by Cisco Talos—has many of its own...

Bring your own LOLBin: Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware

We’ve discussed the challenges that fileless threats pose in security, and how Microsoft Defender Advanced Threat Protection Microsoft Defender ATP employs advanced strategies to defeat these sophisticated threats. Part of the slyness of fileless malware is their use of living-off-the-land...

New FakeNet-NG Feature: Content-Based Protocol Detection

I Matthew Haigh recently contributed to FLARE’s FakeNet-NG network simulator by adding content-based protocol detection and configuration. This feature is useful for analyzing malware that uses a protocol over a non-standard port; for example, HTTP over port 81. The new feature also detects and...

TorWall - Transparent Tor for Windows

Tallow is a small program that redirects all outbound traffic from a Windows machine via the Tor anonymity network. Any traffic that cannot be handled by Tor, e.g. UDP, is blocked. Tallow also intercepts and handles DNS requests preventing potential leaks. Tallow has several applications,...

Windows Packet Divert: WinDivert

Windows Packet Divert WinDivert is a user-mode packet capture-and-divert package for Windows Vista, Windows 2008, Windows 7, Windows 8 and Windows 10. WinDivert allows usermode programs to capture/modify/drop network packets sent to/from the Windows network stack. In summary, WinDivert can captur...