@0xPat

Red/purple teamer https://xitter.cf/t.co/AhR2vq4vuU

 Warsaw, Poland
0xpat.github.io
Joined February 2020
  • Tweets18
  • Following27
  • Followers1.3K
I'm giving 2 talks at @layer_one together with @c0p0x this weekend: layerone.org/schedule/ #purpleteam #malware
3
4
x33fcon.com/#!s/malware.md This year during @x33fcon we will code some covert shellcode loader in C++ @c0p0x #redteam #purpleteam #malware #workshop
3
6
31
Patryk Czeczko retweeted
/ˈziːf-kɒn/
@x33fcon27 Apr 2021
Would you like to learn more about Applied #PurpleTeaming? Come and join us, @0xPat and @c0p0x tomorrow at 1500 UTC. Learn more: x33fcon.com/#!w/purple.md Free registration: x33fcon.com/#!webinarregistr…
1
3
2
10
x33fcon.com/#!/t/purple.md Check out my Applied Purple Teaming training on @x33fcon
1
3
7
Co-trainer @c0p0x
0xpat.github.io/Malware_deve… Implementing COFF loader/injector (aka beacon object file)
1
18
55
0xpat.github.io/Malware_deve… Some advanced obfuscation techniques for C code
44
1
113
0xpat.github.io/Malware_deve… Check out compilation tips, PE overwiew, hiding imports, API hashing and calculating entropy
5
Patryk Czeczko retweeted
Grzegorz Tworek
@0gtweet12 May 2020
Eliminate huge part of lateral movement scenarios with one command: "reg.exe add HKLM\SYSTEM\CurrentControlSet\Control /v DisableRemoteScmEndpoints /t REG_DWORD /d 1" It will make Service Control Manager deaf to remote management. Everything else works properly.
10
297
7
971
Patryk Czeczko retweeted
Andy Robbins@_wald011 May 2020
Did you know that LinkedIn has a directory? linkedin.com/directory/peopl…
1
21
1
110
0xpat.github.io/Malware_deve… detecting debuggers and other tricks to make dynamic analysis of malware harder
1
1
10
Patryk Czeczko retweeted
Vlado Vajdic@vvlado1 May 2020
Detecting APT29: MITRE EDR evaluations round 2 - Jorrit Folmer - Medium -> not everyone is a winner! medium.com/@jorritfolmer/det…

Detecting APT29: MITRE EDR evaluations round 2

MITRE published a fresh set of evaluation results! This time by emulating APT29 against a significantly larger group of twenty one…

medium.com
3
2
0xpat.github.io/Malware_deve… On detecting VMs, evading sandboxes, bypassing function hooks
3
17
47
Well this is awkward 😂 Nice logo tho.
Varonis
@varonis22 Apr 2020
⚠ Our research team discovered a way to exploit Pass-Through Authentication in an #O365 / #Azure environment, login as *any user* and dump credentials. READ: varonis.com/blog/azure-skele… #Office365 #remoteworkforce #infosec #Azure #threatresearch

Azure Skeleton Key: Exploiting Pass-Through Auth to Steal Credentials

We created a proof-of-concept that manipulates the Azure authentication function to give us a ‘skeleton key’ password that will work for all users, and dump all real clear-text usernames and passwo...

varonis.com
3
20
1
123
Patryk Czeczko retweeted
Marc Smeets@MarcOverIP24 Apr 2020
In case you missed it: Im writing a multi part blog on RedELK, @OutflankNL’s open sourced tooling that acts as a red team SIEM and helps with overall improved oversight during red team operations: outflank.nl/blog/2019/02/14/… outflank.nl/blog/2020/02/28/… outflank.nl/blog/2020/04/07/…

Introducing RedELK - Part 1: why we need it | Outflank

This first post covers the reasoning for RedELK. We cover the value we believe it adds and the approach we took in designing the tool.

outflank.nl
2
43
1
142
Patryk Czeczko retweeted
Grzegorz Tworek
@0gtweet24 Apr 2020
Wanted to demonstrate AdjustTokenPrivileges() -> SomePrivilegedCall() sequence, and failed with SetSystemTime(). And now I know: SetSystemTime() tries to adjusts privileges on it's own, not even checking the result, and then calls NtSetSystemTime() syscall. Interesting...
5
20
0xpat.github.io/Malware_deve… on developing shellcode loader
1
9
1
20
Load more