X-Technobro retweeted
Two more EDR killers just landed on LOLDrivers, both from Jehad Abudagga's (@j3h4ck) KillerLand research.
Same BYOVD play: load a signed driver, hand it a PID, and let the kernel terminate the security tools for you.
github.com/redteamfortress/K…
X-Technobro retweeted
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
X-Technobro retweeted
While looking for MSBuild alternatives, I came across VisualStudio's TextTransform utility which can execute C# code embedded in `.tt` files - something I haven't seen in the wild before, so naturally, I had to make a tool around it to run shellcode ;)
github.com/whokilleddb/TTs
X-Technobro retweeted
What happens when Chromium becomes an offensive tool?
Our latest SO:Brief features @KingOfTheNOPs and @ScoubiMtl on Silent Chrome, offensive tradecraft, and what it means for defenders.
Go deeper with Andrew’s research 👉 ghst.ly/45S1ZgW
X-Technobro retweeted
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
X-Technobro retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
X-Technobro retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
X-Technobro retweeted
New post: Writing a Beacon Object File from scratch in C.
COFF internals, dynamic import resolution, and building a privilege enumeration BOF - no frameworks, no wrappers.
Plus why execute-assembly lights up every EDR while BOFs barely register.
by7e.dev/blog/bof-from-scrat…
X-Technobro retweeted
A Beacon Object File (BOF) for Cobalt Strike and Mythic C2 that implements COM hijacking for persistence on Windows systems. github.com/bsdrip/COM_Hijack…
X-Technobro retweeted
Token Theft in Microsoft Entra ID, by @insinuator
Part 1: Threat Landscape and Attack Techniques insinuator.net/2026/08/token…
Part 2: Continuous Access Evaluation insinuator.net/2026/09/token…
Part 3: Token Protection insinuator.net/2026/10/token…
X-Technobro retweeted
But it doesn't just affect Intune + NSIS - any MDM solution that allows users to self-install apps, and other installer packaging frameworks could also be vulnerable.
Details on the @AmberWolfSec blog:
blog.amberwolf.com/blog/2026…
X-Technobro retweeted
🟣 Weekly Purple Team: DLL Sideloading
Adaptix Beacon hidden inside python315.dll. Legit process, malicious payload, C2 up and running.
Then we show you how to catch the sideload 👀
Red vs. blue breakdown 🎥
youtu.be/szXFXvaXiEs
#PurpleTeam #RedTeam #BlueTeam #DLLSideloading #AdaptixBeacon #C2 #DetectionEngineering #MITREATTACK #CyberSecurity
X-Technobro retweeted
If you're into adversary simulation, identity security or red/blue tradecraft, bookmark this.
The team at @SpecterOps has built one of the best FREE security research archives online.
The rabbit hole covers:
- Active Directory + Kerberos
- Entra ID + Azure
- Okta + identity providers
- BloodHound + attack paths
- SCCM / Configuration Manager
- Red team tradecraft
- Detection engineering
- Lateral movement
- Credential access
- OAuth + token security
- Browser persistence
- AWS + cloud attack paths
- Kubernetes security
- Software supply chain attacks
- Adversary simulation
- Purple teaming
- Threat hunting
- AI-assisted offensive security
There is a ridiculous amount of deep technical material here, including research developed from real offensive and defensive operations.
They also now have FREE on-demand Tradecraft Academy courses covering BloodHound, Kubernetes for Red Teamers and software supply chain security.
Blog:
specterops.io/blog/
Free Tradecraft Academy:
academy.specterops.io/
Huge credit to the @SpecterOps team for publishing so much of this openly.
#RedTeam #ActiveDirectory #Infosec
X-Technobro retweeted
Some additional strategic moves from @_CobaltStrike!
The @OutflankNL acquisition was a key step, and offering this course as a Cobalt Strike add-on is another indicator that, with sufficient customisation, Cobalt Strike remains effective in 2026.
A good reminder to everyone who claimed Cobalt Strike was dead because of signatures and detections.
✨New Training: Cobalt Strike Certified Operator II ✨
CSCO II goes past the basics into advanced evasion, with in-depth guidance on UDRLs, Sleep Mask, Beacon Gate, UDC2, and more. Ideal for those who are ready to level up their Cobalt Strike skill set.
cobaltstrike.com/blog/cobalt…
X-Technobro retweeted
With PR 2325, you can now expand your ESC8 relay targets in impacket to include CES web enrollment endpoints 🚀
github.com/fortra/impacket/p…
X-Technobro retweeted
Carefully crafted LDAP tactics to stay under the AD detection radar.
A post by Baptiste Crépin.
Source: cravaterouge.com/articles/ld…
#redteam #blueteam #offcoding
X-Technobro retweeted
Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse!
EDR Eclipse is also compatible with ShellcodePack and MacroPack formats as well as all major C2s!
blog.balliskit.com/tutorial-…
#redteam
