Getting third party C2 channels to work effortlessly with any implant.
Coming Soon! C3 is great but takes too much work to get a new C2 framework to work with it, and hasn’t been fully updated. The included covenant connector do...
Posts
2022
Probing VirusTotal sandboxes for custom detection markers.
If you ever uploaded a live implant to VirusTotal you will notice many callbacks from sandboxes. A common defense faced by attackers is the use of EDRs that ...
2021
Hello World!
I have migrated my blog from Keystone.js to Jekyll. I have also switched from self hosting to using GitHub pages.
2019
Spear Phishing with Word Macro and Decoy Document
Microsoft Word macros are often utilized in spear phishing attacks. These documents typically include a lure to trick the user into clicking “Enable Content....
2018
Stealthy and Efficient Data Exfiltration using Google Drive
Data exfiltration is a continual process during the post-exploitation stage. After initial entry, the attacker targets the domain admins. The attackers often...
Detecting Meterpreter Malware In Memory With Yara
My plan is fairly simple: read the memory of each process and scan it for static indicators of meterpreter.
Improving PowerShell Script Obfuscation Part 1
Public PowerShell obfuscators like Invoke-Obfuscation and ISE Steroids do not actually rename the function and variable names, which makes easier to use beca...
Bypassing Kaspersky Antivirus with python.exe and Pupy
Kaspersky antivirus is notorious for being difficult to bypass. Black Hills did an interesting blog post where they experienced difficulty bypassing Kasp...
2017
Google Open Redirect
Edit: Google fixed this by introducing a redirect warning page that requires the user to click the redirected link.
The Three Types of Ransomware
Ransomware encrypts data and demands ransom money for the decryption key. The ransomware threat is growing, and it is increasingly targeting businesses. Whil...
Guessing Email Addresses from Names for Spear Phishing
Spear phishing, a targeted form of phishing, is a major security threat for all organizations. Both cybercriminals and nation-state sponsored hackers favor t...