Probing VirusTotal sandboxes for custom detection markers.
If you ever uploaded a live implant to VirusTotal you will notice many callbacks from sandboxes. A common defense faced by attackers is the use of EDRs that ...
Posts by Category
- av-bypass 3
- phishing 2
- malware 1
- web 1
- implant 1
- obfuscation 1
- antivirus 1
- exfiltration 1
- misc 1
- Implants 1
av-bypass
Improving PowerShell Script Obfuscation Part 1
Public PowerShell obfuscators like Invoke-Obfuscation and ISE Steroids do not actually rename the function and variable names, which makes easier to use beca...
Bypassing Kaspersky Antivirus with python.exe and Pupy
Kaspersky antivirus is notorious for being difficult to bypass. Black Hills did an interesting blog post where they experienced difficulty bypassing Kasp...
phishing
Spear Phishing with Word Macro and Decoy Document
Microsoft Word macros are often utilized in spear phishing attacks. These documents typically include a lure to trick the user into clicking “Enable Content....
Guessing Email Addresses from Names for Spear Phishing
Spear phishing, a targeted form of phishing, is a major security threat for all organizations. Both cybercriminals and nation-state sponsored hackers favor t...
malware
The Three Types of Ransomware
Ransomware encrypts data and demands ransom money for the decryption key. The ransomware threat is growing, and it is increasingly targeting businesses. Whil...
web
Google Open Redirect
Edit: Google fixed this by introducing a redirect warning page that requires the user to click the redirected link.
implant
Bypassing Kaspersky Antivirus with python.exe and Pupy
Kaspersky antivirus is notorious for being difficult to bypass. Black Hills did an interesting blog post where they experienced difficulty bypassing Kasp...
obfuscation
Improving PowerShell Script Obfuscation Part 1
Public PowerShell obfuscators like Invoke-Obfuscation and ISE Steroids do not actually rename the function and variable names, which makes easier to use beca...
antivirus
Detecting Meterpreter Malware In Memory With Yara
My plan is fairly simple: read the memory of each process and scan it for static indicators of meterpreter.
exfiltration
Stealthy and Efficient Data Exfiltration using Google Drive
Data exfiltration is a continual process during the post-exploitation stage. After initial entry, the attacker targets the domain admins. The attackers often...
misc
Hello World!
I have migrated my blog from Keystone.js to Jekyll. I have also switched from self hosting to using GitHub pages.
Implants
Getting third party C2 channels to work effortlessly with any implant.
Coming Soon! C3 is great but takes too much work to get a new C2 framework to work with it, and hasn’t been fully updated. The included covenant connector do...