Last week's news and how-tos in the art and science of Detection Engineering

We are working diligently to understand the scope of the incident and identify what specific information has been accessed.

Laika helps companies manage compliance, obtain security certifications, and build trust with enterprise customers.

An open source append only database of known subdomains to discover, store and serve subdomains as fast as possible.

Isn’t there a better moment than the Holiday season to release a major update of our RDP Attack and Eavesdropping tool PyRDP? That’s right, pour yourself a little glass of eggnog, sit in a comfortable chair, put on some Christmas music and read about the…

Overview of current GLIBC heap exploitation techniques up to GLIBC 2.34, including their ideas and introduced mitigations along the way

In this blog post, we present new techniques for recovering the NTLM hash from an encrypted credential protected by Windows Defender…

Contribute to scarvell/advisories development by creating an account on GitHub.

An abbreviated guide to scaling automated security testing using tooling from the Prelude ecosystem.

Load shared object (PHP extension) from memory

Introduction In this article, I will present a new technique to bypass Microsoft’s Anti-Malware Scan Interface (AMSI) using API Call Hooking of CLR methods. When executed on a Windows system,…

🔐 A CLI tool to extract server certificates. Contribute to Hakky54/certificate-ripper development by creating an account on GitHub.

Demonstrates why it's not safe to download random save files from the Internet - swoops/video-game-save-file-trojans

Cobalt Strike BOF that identifies Attack Surface Reduction (ASR) rules, actions, and exclusion locations - GitHub - mlcsec/ASRenum-BOF: Cobalt Strike BOF that identifies Attack Surface Reduction (A...

(A Script that Solicits GPT-3 for Comments on Decompiled Code)

I was recently rewarded a total of $107,500 by Google for responsibly disclosing security issues in the Google Home smart speaker that allowed an attacker within wireless proximity to install a “backdoor” account on the device, enabling them to send commands…

A tool to monitor for potential spear phishing domains and send to Slack. - GitHub - hazcod/dnstwist: A tool to monitor for potential spear phishing domains and send to Slack.

We recently discovered a new ransomware variant, which performs MSDTC service DLL Hijacking to silently execute its payload. We have named this ransomware CatB, based on the contact email and performed an analysis on how it works.

Redirecting….