Powershell Logging: Obfuscation and some New(ish) Bypasses

Part1:
https://www.bc-security.org/post/powershell-logging-obfuscation-and-some-newish-bypasses-part-1

Part2:
https://www.bc-security.org/post/powershell-logging-obfuscation-and-some-newish-bypasses-part-2

@WindowsHackingLibrary

Following Donut Crumbs

https://riccardoancarani.github.io/2020-10-10-donut-crumbs

@WindowsHackingLibrary

Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative

https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative

@WindowsHackingLibrary

Introduction to Threat Intelligence ETW

A quick look into ETW capabilities against malicious API calls.

https://undev.ninja/introduction-to-threat-intelligence-etw

@BlueTeamLibrary

Active Directory (AD) Attacks & Enumeration at the Network Layer

https://www.lares.com/blog/active-directory-ad-attacks-enumeration-at-the-network-layer

@WindowsHackingLibrary

Process Herpaderping:
Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself.

https://jxy-s.github.io/herpaderping

@WindowsHackingLibrary

Using and detecting C2 printer pivoting

https://labs.f-secure.com/blog/print-c2

@WindowsHackingLibrary

Using Custom Covenant Listener Profiles & Grunt Templates to Elude AV

https://offensivedefence.co.uk/posts/covenant-profiles-templates

@WindowsHackingLibrary

WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques

https://www.fireeye.com/blog/threat-research/2020/11/wow64-subsystem-internals-and-hooking-techniques.html

@WindowsHackingLibrary

Windows RpcEptMapper Service Insecure Registry Permissions EoP

https://itm4n.github.io/windows-registry-rpceptmapper-eop

@WindowsHackingLibrary

Purgalicious VBA: Macro Obfuscation With VBA Purging

https://www.fireeye.com/blog/threat-research/2020/11/purgalicious-vba-macro-obfuscation-with-vba-purging.html

@WindowsHackingLibrary

Module Stomping in C#

https://offensivedefence.co.uk/posts/module-stomping

@WindowsHackingLibrary

Gnome is a module to load your signed driver stealthily. The driver is extracted from the Gnome loader, dropped to disk and loaded using NtLoadDriver instead of the usual service creation driver loading which can be noisy and leaves large forensic artefacts behind such as service creation, service start/stop logs etc.

https://github.com/slaeryan/AQUARMOURY/tree/master/Gnome

@WindowsHackingLibrary

Exploiting a “Simple” Vulnerability – In 35 Easy Steps or Less!

https://windows-internals.com/exploiting-a-simple-vulnerability-in-35-easy-steps-or-less

@WindowsHackingLibrary

Forging malicious DOC, undetected by all VirusTotal static engines

https://arielkoren.com/blog/2020/12/24/forging-malicious-doc

@WindowsHackingLibrary

A Modern Exploration of Windows Memory Corruption Exploits - Part I: Stack Overflows

https://www.forrest-orr.net/post/a-modern-exploration-of-windows-memory-corruption-exploits-part-i-stack-overflows

@WindowsHackingLibrary

R.I.P ROP: CET Internals in Windows 20H1

http://windows-internals.com/cet-on-windows

@WindowsHackingLibrary

Breaking The Browser – A tale of IPC, credentials and backdoors

https://www.mdsec.co.uk/2021/01/breaking-the-browser-a-tale-of-ipc-credentials-and-backdoors

@WindowsHackingLibrary

Offensive Windows IPC Internals 1: Named Pipes

https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html

@WindowsHackingLibrary

Using Spotify Playlists as Malware CDN | C2Tify

https://kaganisildak.com/2021/01/14/using-spotify-playlists-as-malware-cdn-c2tify

Github repo: https://github.com/kaganisildak/c2tify

@WindowsHackingLibrary

BitLocker Lockscreen bypass

https://secret.club/2021/01/15/bitlocker-bypass.html

@WindowsHackingLibrary