Remote kernel debugging "lateral movement" via WMI. An example of one of the many use cases for new #PowerShell BCD module (still in very early stages).
https://github.com/mattifestation/BCD
https://github.com/mattifestation/BCD
Db_hEGSVMAIPcbb.jpg
260.9 KB
Run a CobaltStrike beacon from a Microsoft Signed Binary vsjitdebugger.exe
https://vincentyiu.co.uk/cobaltsplunk/
Cobalt Strike Splunk Application for CobaltStrike available here https://github.com/vysec/CobaltSplunk. It parses Cobalt Strike logs, and has some predefined dashboards and queries
Cobalt Strike Splunk Application for CobaltStrike available here https://github.com/vysec/CobaltSplunk. It parses Cobalt Strike logs, and has some predefined dashboards and queries
