Understanding WdBoot (Windows Defender ELAM)

https://n4r1b.com/posts/2019/11/understanding-wdboot-windows-defender-elam/

#windows #defender #av #reverse

Extract Windows Defender database from vdm files and unpack it

https://github.com/hfiref0x/WDExtract

#windows #defender #av #vdm #signuature #unpack

Defender Pretender: When Windows Defender Updates Become a Security Risk

https://www.safebreach.com/blog/defender-pretender-when-windows-defender-updates-become-a-security-risk/

#windows #defender #av #signature #vdm

An unexpected journey into Microsoft Defender's signature World

https://retooling.io/blog/an-unexpected-journey-into-microsoft-defenders-signature-world

#windows #defender #av #signature

PEAKLIGHT: Decoding the Stealthy Memory-Only Malware | Google Cloud Blog

https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/

#analysis #memonly

Operation DevilTiger: 0day vulnerability techniques and tactics used by APT-Q-12 disclosed

https://ti.qianxin.com/blog/articles/operation-deviltiger-0day-vulnerability-techniques-and-tactics-used-by-apt-q-12-disclosed-en/

#analysis #apt

Analysis of two arbitrary code execution vulnerabilities affecting WPS Office

https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/

#analysis #apt #exploit #wps #office

Obfuscated PowerShell leads to Lumma C2 Stealer

https://www.ontinue.com/resource/obfuscated-powershell-leads-to-lumma-c2-stealer/

#analysis #lummac2 #stealer

Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing
https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing

Masking Malicious Memory Artifacts – Part II: Blending in with False Positives
https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-ii-insights-from-moneta

Masking Malicious Memory Artifacts – Part III: Bypassing Defensive Scanners
https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-iii-bypassing-defensive-scanners

#research #memory #artifacts

Meet UULoader: An Emerging and Evasive Malicious Installer.

https://cyberint.com/blog/research/meet-uuloader-an-emerging-and-evasive-malicious-installer/

#analysis #loader #msi

Ransomware Tool Matrix

- The repository contains a list of which tools each ransomware gang or extortionist gang uses
- As defenders, we should exploit the fact that many of the tools used by these cybercriminals are often reused
- We can threat hunt, deploy detections, and block these tools to eliminate the ability of adversaries to launch intrusions
- The project will be updated as additional intelligence on ransomware gang TTPs is made available

https://github.com/BushidoUK/Ransomware-Tool-Matrix

#analysis #tools

Stealer devs bypass Chrome's new cookie protection

https://news.risky.biz/risky-biz-news-stealer-devs-bypass-chromes-new-cookie-protection/

#chrome #cookies #stealers

Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain

https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400k-linux-servers-compromised-cryptotheft-financial-gain/

TA Phone Home: EDR Evasion Testing Reveals Extortion Actor's Toolkit

https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Notify Routine callbacks, Object Callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.

https://github.com/wavestone-cdt/EDRSandblast/

#tool #redteam #edr #bypass

This is a new bypass technique for memory scanners. It is useful in hiding problematic code that will be flagged by the antivirus vendors.

This is basically an improved version of Voidgate, but without all of the previous limitations.

This technique is compatible with all C2 beacons, it handles multithreaded payloads and it can handle executables generated by tools such as pe_to_shellcode, thus allowing it to run virtually any non .NET executables.

https://github.com/vxCrypt0r/Voidmaw

#tool #redteam #bypass

A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders implemented by C2 beacons) or other problematic executables that will be flagged by the antimalware programs(such as mimikatz).

https://github.com/vxCrypt0r/Voidmaw

Introducing Early Cascade Injection: From Windows Process Creation to Stealthy Injection

https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/

From C to shellcode (simple way)

https://print3m.github.io/blog/from-c-to-shellcode

DLL Sideloading is a technique that enables the attacker to execute custom malicious code from within legitimate – maybe even signed – windows binaries/processes.

https://www.r-tec.net/r-tec-blog-dll-sideloading.html

Ghost is a shellcode loader project designed to bypass multiple detection capabilities that are usually implemented by an EDR

https://github.com/cpu0x00/Ghost

#edr #bypass #loader