maldev hobbyist. glasses. mustache.
Joined October 2019
- Tweets104
- Following272
- Followers653
- Likes1.3K
Christian W retweeted
Hacking is boring.
Wanna know what's fun? Browsing MSDN documentation at 2 o'clock in the morning, looking for APIs to potentially abuse in malware. It'll also probably never go in the wild and it'll go unappreciated for several months or even years.
That's where the fun is
Christian W retweeted
Happy to get this out the door: cloud.google.com/blog/topics…
Big thanks to @onfvp @jinx_soda @nicastronaut and the other named and unnamed authors.
A few highlights ⬇️
Christian W retweeted
I'm exited to release GraphStrike, a project I completed during my internship at @RedSiege. Route all of your Cobalt Strike HTTPS traffic through graph.microsoft.com.
Tool: github.com/RedSiege/GraphStr…
Dev blog: redsiege.com/blog/2024/01/gr…
#redteam #infosec #Malware #Microsoft
Christian W retweeted
I'm VERY HAPPY to say that my Blogpost is out!!!!
As a content, we'll discuss about how to exploit a simple (not so much) TypeConfusion vulnerabilities in a modern windows versions (Windows 11 22621).
Now let's get our SYSTEM privileged shell!
wafzsucks.medium.com/how-a-s…
Christian W retweeted
Zero day summer continues, late Friday blog release because the baddies never sleep. mandiant.com/resources/blog/…
Christian W retweeted
[Blog] No Alloc, No Problem: Leveraging Program Entry Points for Process Injection
An analysis of AddressOfEntryPoint and the 'new' ThreadQuerySetWin32StartAddress (ThreadQuery) process injection techniques
bohops.com/2023/06/09/no-all…
Christian W retweeted
"Mandiant has observed wide exploitation of a zero-day vulnerability in the MOVEit Transfer secure managed file transfer software for subsequent data theft."
UNC4857 observed actively deploying the LEMURLOOT webshell post-exploitation.
mandiant.com/resources/blog/…
Christian W retweeted
My analysis of Brute Ratel is now up on my blog.
protectedmo.de/brute.html
Christian W retweeted
cdn.discordapp.com/attachmen…
maybe interesting for others
Christian W retweeted
We've updated the vx-underground Windows Malware paper collection
- 17 new Callback Injection / Shellcode execution techniques
- Internals: Inside the Windows Cache Manager
- Internals: Understanding DISM - Servicing Stack Interaction
Check it out here: vx-underground.org/windows.h…
Christian W retweeted
We've updated the vx-underground Windows Malware paper collection.
We have added 17 different shellcode execution / callback injection techniques in C# by @_Wra7h.
You can check it out here: vx-underground.org/windows.h…
Christian W retweeted
I'm happy to share the results of months of research on code injection, process tampering, and their detection! 🥳
Here you'll find technique categorization, a dive into the underlying OS mechanisms, sample demos, detection suggestions, and much more:
huntandhackett.com/blog/conc…
Christian W retweeted
Taking a look at SCCM on this lazy Sunday evening? Of course you are, what else is there to do?! One of the things that's likely to draw your interest are just how all those user accounts are stored. Check out the SC_UserAccount table in the SQL DB.
Christian W retweeted
Large update to the Windows malware paper collection...
New sections:
-Data Theft
-Evasion: EDR & AV specific
-Evasion: Process Creation & Shellcode Execution
-Evasion: Syscalls & Memory Evasion
-Initial Access Malcode
-Network Communications
and more...
vx-underground.org/windows.h…
Christian W retweeted
NtRaiseHardError is a funny Win32 API. It can be used to cause a bluescreen without administrator privileges.
However, it can also be used to show message boxes, even from kernel-mode.
I explain how it works in this blog post:
vollragm.github.io/posts/ker…
Christian W retweeted
A quick thread examining the network artifacts of the HermeticWizard spreading. Found an inaccuracy? Plz let us know!
1⃣ WMI Spreading supports SMB1 and SMB2, copies HermeticWizard as a .dll file in the C:\Windows directory via the ADMIN$ share in the format of c[A-F0-9]{12}.dll
ALT A screenshot of Wireshark showing the HermeticWizard file being created via SMB1
Christian W retweeted
A new module for DInjector! ClipboardPointer copies shellcode bytes into the clipboard, sets RX on it and executes the shellcode like a function via a delegate pointer. The technique is based on a recent ClippyShellcodeInject.cs gist 📋 by @_Wra7h github.com/snovvcrash/DInjec…
Christian W retweeted
Reminder: Sysmon can help you detect this (Event ID 24)
This quoted post is unavailable.
