Network Security Channel – Telegram
Network Security Channel
@Engineer_Computer
2.55K subscribers
5.33K photos
3.42K videos
5.56K files
4.44K links
شروع از سال 1395
✅ Security Operation Center (SOC)
✅ Bug Bounty
✅ Vulnerability
✅ Pentest
✅ Hardening
✅ Linux
✅ Reasearch
✅ Security Network
✅ Security Researcher
✅ DevSecOps
✅ Blue Team
✅ Red Team
Download Telegram
About
Blog
Apps
Platform
Join
Network Security Channel
2.55K subscribers
Network Security Channel
⭕️ یک تکنیک جالب از سری تکنیک های Anti-forensic در DLL-Injection وجود دارد که با نام DLL Unlinking شناخته می شود.
این تکنیک از ویژگی های Windows Process Environment Block (PEB) استفاده می کند تا بتواند DLL های مورد نظر را به صورت پنهان لود کند.

‏PEB شامل یک اشاره گر به ساختار PEB_LDR_DATA است که درون آن لیستی ازعناصر LDR_DATA_TABLE_ENTRY وجود دارد که به صورت Doubly-linked برای هرپروسه در Virtual Memory ذخیره می شود.
این لیست ها شامل موارد زیر میباشد :

InLoadOrderModuleList InMemoryOrderModuleList InInitializationOrderModuleList

برای استفاده از تکنیک DLL Unlinking، می توان از ابزاری با زبان NIM استفاده کرد که با استفاده از این کد می توان DLL های مورد نظر را از ‏ ‏doubly-linked لیست ها Unlink کرد، از جمله این موارد :
InLoadOrderModuleList InMemoryOrderModuleList InitializationOrderModuleList LdrpHashTable

باید توجه داشت که پس از Unlink کردن یک DLL ، هنوز هم ممکن است این DLL را با استفاده از ابزارهای مشابه Process Hacker مشاهده کنیم زیرا این ابزارها می توانند ماژول های بارگذاری شده را از VAD یا Virtual Address Denoscriptors به جای لیست های مربوط به فضای کاربر دریافت کنند.

https://blog.christophetd.fr/dll-unlinking/
https://github.com/frkngksl/UnlinkDLL
#RedTeam #MalDev

@Engineer_Computer
Christophe Tafani-Dereeper
Hiding in Plain Sight: Unlinking Malicious DLLs from the PEB - Christophe Tafani-Dereeper
In this post, we take a look at an anti-forensics technique that malware can leverage to hide injected DLLs. We dive into specific details of the Windows Process Environment Block (PEB) and how to abuse it to hide a malicious loaded DLL. Background: You may…
180 views
Network Security Channel
📊بررسی الگوهای حمله با استفاده از SIEM، Sysmon Utility و MITER ATT&CK

⛓ https://medium.com/@kelvin_ling/investigate-attack-patterns-using-siem-sysmon-utility-and-mitre-att-ck-5a569b2a9d4b

@Engineer_Computer
Medium
Investigate Attack Patterns using SIEM, Sysmon Utility and MITRE ATT&CK
In the “New Hire Old Artifacts” TryHackMe room, we can investigate a cyber incident using SIEM software — Splunk. The logs provided to…
166 views
Network Security Channel
🔐 Is Your Team ACTUALLY Ready For a Cyber Attack?

Sure you have:

— Documents and plans
— The latest security tools
— 24/7 monitoring and operations

But is that really enough in the modern world of advanced technologies?

Don't leave it to chance.


"The Essential Cybersecurity Exercise Playbook" helps you run exercises to validate the readiness.

✔️Try it out, minimize the risk:

→ https://gumroad.com/a/989009875/feordo

@Engineer_Computer
166 views
Network Security Channel
PoC Released for SharePoint Pre-Auth RCE Chain (CVE-2023-29357 & CVE-2023-24955)
https://gist.github.com/testanull/dac6029d306147e6cc8dce9424d09868
https://securityonline.info/poc-released-for-sharepoint-pre-auth-rce-chain-cve-2023-29357-cve-2023-24955/

@Engineer_Computer
Gist
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC - SharePwn_public.py
172 views
Network Security Channel
poc cve-2023-29357 unauthenticate rce sharepoint

@Engineer_Computer
178 views
Network Security Channel
PoC Released for SharePoint Pre-Auth RCE Chain (CVE-2023-29357 & CVE-2023-24955)
https://gist.github.com/testanull/dac6029d306147e6cc8dce9424d09868
https://securityonline.info/poc-released-for-sharepoint-pre-auth-rce-chain-cve-2023-29357-cve-2023-24955/

@Engineer_Computer
Gist
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC - SharePwn_public.py
241 views
Network Security Channel
روش جدید تزریق در پراسس برای دور زدن EDR

https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/new-mockingjay-process-injection-technique-evades-edr-detection/amp/

@Engineer_Computer
www-bleepingcomputer-com.cdn.ampproject.org
New Mockingjay process injection technique evades EDR detection
A new process injection technique named 'Mockingjay' could allow threat actors to bypass EDR (Endpoint Detection and Response) and other security products to stealthily execute malicious code on compromised systems.
233 views
Network Security Channel
Forwarded from Network Security Channel
PoC Released for SharePoint Pre-Auth RCE Chain (CVE-2023-29357 & CVE-2023-24955)
https://gist.github.com/testanull/dac6029d306147e6cc8dce9424d09868
https://securityonline.info/poc-released-for-sharepoint-pre-auth-rce-chain-cve-2023-29357-cve-2023-24955/

@Engineer_Computer
Gist
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC - SharePwn_public.py
91 views
Network Security Channel
Forwarded from Network Security Channel
روش جدید تزریق در پراسس برای دور زدن EDR

https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/new-mockingjay-process-injection-technique-evades-edr-detection/amp/

@Engineer_Computer
www-bleepingcomputer-com.cdn.ampproject.org
New Mockingjay process injection technique evades EDR detection
A new process injection technique named 'Mockingjay' could allow threat actors to bypass EDR (Endpoint Detection and Response) and other security products to stealthily execute malicious code on compromised systems.
117 views
Network Security Channel
Common_developer_security_mistakes_in_working_with_IPG_Security.pdf
83.3 KB
💥 Common developer security mistakes in working with IPG

As a security engineer, pentester or developer you should know about common security mistakes in working with IPG that leads to serious security vulnerabilities.

#AppSec #IPG

@Engineer_Computer
219 views
Network Security Channel
This media is not supported in your browser
VIEW IN TELEGRAM
#IRIB Unlettered #Gas Stations #Hacked

یادی کنیم از سامانه ضد نفوذ جایگاه سوخت فرصت طلبان بی سواد و صدای سیمای بی سواد تر...

@Engineer_Computer
256 views
Network Security Channel
#امریه #استخدام #امنیت
@Engineer_Computer
809 views
Network Security Channel
APT-WIKI.pdf
86.2 MB
#HADESS
@Engineer_Computer
223 views
Network Security Channel
#linux
@Engineer_Computer
222 views
Network Security Channel
مرکز امنیت هوش مصنوعی NSA
https://www.nsa.gov/AISC/

@computer_engineer2
www.nsa.gov
Artificial Intelligence Security Center | National Security Agency
To ensure NSA's ability to stay in front of our adversaries' tactics and techniques surrounding artificial intelligence (AI), the Agency launched the NSA Artificial Intelligence Security Center (AISC). The AISC will be a key part of NSA's cybersecurity mission…
212 views
Network Security Channel
https://center-for-threat-informed-defense.github.io/sensor-mappings-to-attack/

برای متخصصین SOC

@computer_engineer2
193 views
Network Security Channel
کدام رمزنگاری فعلا دربرابر فناوری کوانتوم مقاوم است ؟

https://medium.com/asecuritysite-when-bob-met-alice/why-is-128-bit-aes-insecure-for-a-quantum-computer-but-256-bit-is-not-814a8a9d6500

@computer_engineer2
Medium
Why is 128-bit AES Insecure for a Quantum Computer, But 256-bit Is Not?
If I have an unsorted database with 10 billion words, and I want to search for one of the words. With a normal search, it would take an…
187 views
Network Security Channel
انتقال تجربه

سریع عمل کردن بر اساس داده های موجود میتونه اینطوری باشه


پس ۴ عنصر در اینجا مهم است :

سورس داده مناسب

یوزکیس نویسی درست همراه با داشبورد های مناسب

اولویت بندی آلرت ها

هوشمندی و با سوادی عامل نظارتی انسانی

نتیجه : کاهش هزینه برای بیزنس( دقت کنید از کلمه ای فنی در این عبارت استفاده نشد )
@computer_engineer2
208 views
Network Security Channel
Cyber Security Governance Principles.pdf
14 MB
اصول حکمرانی امنیت سایبری
@computer_engineer2
711 views
Network Security Channel
@Engineer_Computer
192 views
Network Security Channel
Cryptography and Network Security.pdf
10.8 MB
@Engineer_Computer
203 views