😽 Malware Development – Registry Key Manipulation

#malware_development #maldev
#windows_internals

https://threathunters.blog/malware-development-create-a-registry-key/
@ZwLowLevel

✉️ Tomiris wreaks Havoc: New tools and techniques of the APT group

#apt
@ZwLowLevel

🐧 Mature audit. Tetragon demonstrates the tremendous power of eBPF

#ebpf #linux_kernel #ring0

@ZwLowLevel
https://hackmag.com/coding/ebpf-tetragon

🚀 StyxLoaderX-EDR-Evasion - Navigate EDR Evasion with Ease

StyxLoaderX-EDR-Evasion is a modular framework designed for advanced evasion techniques against Endpoint Detection and Response systems on Windows x64.

#process_injection #malware_development
#maldev

@ZwLowLevel
https://github.com/spontopt/StyxLoaderX-EDR-Evasion

😎 Experimenting with Object Initializers in Windows

#windows_internals #kernel_callbacks
#windows_kernel #reverse_engineering

@ZwLowLevel
https://revers.engineering/beyond-process-and-object-callbacks-an-unconventional-method/

🥅 Evil Routing: Pulling Off a Sophisticated Wi‑Fi Man‑in‑the‑Middle (MITM) Attack

#mitm #sniffer

@ZwLowLevel

1️⃣ nt-load-order Part 1: WinDbg'ing our way into the Windows bootloader

2️⃣ nt-load-order Part 2: More than you ever wanted to know

#windows_internals #reverse_engineering
#windbg #bootloader

@ZwLowLevel

👣 Pwning the Domain: Lateral Movement.

• Lateral movement in red teaming is all about moving between targets in the environment to reach the objective.

- Password;
- WinRM;
- RDP;
- MSSQL;
- SMB;
- Interactive-shell;
- NTHash;
- Pass-the-Hash;
- Overpass-the-Hash;
- Pass-the-Key;
- MSSQL;
- Execute OS Commands;
- Trusted Link Abuse in MS SQL;
- SCCM (MECM);
- Credential Harvest;
- Network Access Account;
- Client Push Credentials;
- Application & Script Deployment;
- Security Research.

#AD #Пентест

😈 String Obfuscator

#obfuscate #anti_debugging
#anti_analysis

@ZwLowLevel
https://github.com/JungliBro/obfuscator

🛡 Landlock-ing Linux

Landlock is a Linux Security Module (LSM) available since Linux 5.13. Unlike MAC frameworks such as SELinux or AppArmor, Landlock applies transient restrictions: policies are created at runtime, enforced on the current thread and its future descendants, and disappear when the process exits.

#linux_kernel #linux_internals

@ZwLowLevel
https://blog.prizrak.me/post/landlock/

🐒 Malware development part 2 - anti dynamic analysis & sandboxes

#malware_development #maldev
#anti_debugging #anti_analisys

@ZwLowLevel
https://0xpat.github.io/Malware_development_part_2/