Probing VirusTotal sandboxes for custom detection markers.
If you ever uploaded a live implant to VirusTotal you will notice many callbacks from sandboxes. A common defense faced by attackers is the use of EDRs that ...
Posts by Tag
- antivirus 4
- red team 3
- spear phishing 2
- malware 2
- implant 2
- recon 1
- email 1
- ransomware 1
- petya 1
- open redirect 1
- phishing 1
- google 1
- pupy 1
- python 1
- powershell 1
- blue team 1
- meterpreter 1
- post exploitation 1
- google drive 1
- Microsoft Word 1
- macro 1
- decoy 1
- hello 1
- sandbox 1
- VirusTotal 1
- 3rd-party 1
antivirus
Detecting Meterpreter Malware In Memory With Yara
My plan is fairly simple: read the memory of each process and scan it for static indicators of meterpreter.
Improving PowerShell Script Obfuscation Part 1
Public PowerShell obfuscators like Invoke-Obfuscation and ISE Steroids do not actually rename the function and variable names, which makes easier to use beca...
Bypassing Kaspersky Antivirus with python.exe and Pupy
Kaspersky antivirus is notorious for being difficult to bypass. Black Hills did an interesting blog post where they experienced difficulty bypassing Kasp...
red team
Stealthy and Efficient Data Exfiltration using Google Drive
Data exfiltration is a continual process during the post-exploitation stage. After initial entry, the attacker targets the domain admins. The attackers often...
Improving PowerShell Script Obfuscation Part 1
Public PowerShell obfuscators like Invoke-Obfuscation and ISE Steroids do not actually rename the function and variable names, which makes easier to use beca...
Bypassing Kaspersky Antivirus with python.exe and Pupy
Kaspersky antivirus is notorious for being difficult to bypass. Black Hills did an interesting blog post where they experienced difficulty bypassing Kasp...
spear phishing
Spear Phishing with Word Macro and Decoy Document
Microsoft Word macros are often utilized in spear phishing attacks. These documents typically include a lure to trick the user into clicking “Enable Content....
Guessing Email Addresses from Names for Spear Phishing
Spear phishing, a targeted form of phishing, is a major security threat for all organizations. Both cybercriminals and nation-state sponsored hackers favor t...
malware
Getting third party C2 channels to work effortlessly with any implant.
Coming Soon! C3 is great but takes too much work to get a new C2 framework to work with it, and hasn’t been fully updated. The included covenant connector do...
Probing VirusTotal sandboxes for custom detection markers.
If you ever uploaded a live implant to VirusTotal you will notice many callbacks from sandboxes. A common defense faced by attackers is the use of EDRs that ...
implant
Getting third party C2 channels to work effortlessly with any implant.
Coming Soon! C3 is great but takes too much work to get a new C2 framework to work with it, and hasn’t been fully updated. The included covenant connector do...
Probing VirusTotal sandboxes for custom detection markers.
If you ever uploaded a live implant to VirusTotal you will notice many callbacks from sandboxes. A common defense faced by attackers is the use of EDRs that ...
recon
Guessing Email Addresses from Names for Spear Phishing
Spear phishing, a targeted form of phishing, is a major security threat for all organizations. Both cybercriminals and nation-state sponsored hackers favor t...
Guessing Email Addresses from Names for Spear Phishing
Spear phishing, a targeted form of phishing, is a major security threat for all organizations. Both cybercriminals and nation-state sponsored hackers favor t...
ransomware
The Three Types of Ransomware
Ransomware encrypts data and demands ransom money for the decryption key. The ransomware threat is growing, and it is increasingly targeting businesses. Whil...
petya
The Three Types of Ransomware
Ransomware encrypts data and demands ransom money for the decryption key. The ransomware threat is growing, and it is increasingly targeting businesses. Whil...
open redirect
Google Open Redirect
Edit: Google fixed this by introducing a redirect warning page that requires the user to click the redirected link.
phishing
Google Open Redirect
Edit: Google fixed this by introducing a redirect warning page that requires the user to click the redirected link.
Google Open Redirect
Edit: Google fixed this by introducing a redirect warning page that requires the user to click the redirected link.
pupy
Bypassing Kaspersky Antivirus with python.exe and Pupy
Kaspersky antivirus is notorious for being difficult to bypass. Black Hills did an interesting blog post where they experienced difficulty bypassing Kasp...
python
Bypassing Kaspersky Antivirus with python.exe and Pupy
Kaspersky antivirus is notorious for being difficult to bypass. Black Hills did an interesting blog post where they experienced difficulty bypassing Kasp...
powershell
Improving PowerShell Script Obfuscation Part 1
Public PowerShell obfuscators like Invoke-Obfuscation and ISE Steroids do not actually rename the function and variable names, which makes easier to use beca...
blue team
Detecting Meterpreter Malware In Memory With Yara
My plan is fairly simple: read the memory of each process and scan it for static indicators of meterpreter.
meterpreter
Detecting Meterpreter Malware In Memory With Yara
My plan is fairly simple: read the memory of each process and scan it for static indicators of meterpreter.
post exploitation
Stealthy and Efficient Data Exfiltration using Google Drive
Data exfiltration is a continual process during the post-exploitation stage. After initial entry, the attacker targets the domain admins. The attackers often...
google drive
Stealthy and Efficient Data Exfiltration using Google Drive
Data exfiltration is a continual process during the post-exploitation stage. After initial entry, the attacker targets the domain admins. The attackers often...
Microsoft Word
Spear Phishing with Word Macro and Decoy Document
Microsoft Word macros are often utilized in spear phishing attacks. These documents typically include a lure to trick the user into clicking “Enable Content....
macro
Spear Phishing with Word Macro and Decoy Document
Microsoft Word macros are often utilized in spear phishing attacks. These documents typically include a lure to trick the user into clicking “Enable Content....
decoy
Spear Phishing with Word Macro and Decoy Document
Microsoft Word macros are often utilized in spear phishing attacks. These documents typically include a lure to trick the user into clicking “Enable Content....
hello
Hello World!
I have migrated my blog from Keystone.js to Jekyll. I have also switched from self hosting to using GitHub pages.
sandbox
Probing VirusTotal sandboxes for custom detection markers.
If you ever uploaded a live implant to VirusTotal you will notice many callbacks from sandboxes. A common defense faced by attackers is the use of EDRs that ...
VirusTotal
Probing VirusTotal sandboxes for custom detection markers.
If you ever uploaded a live implant to VirusTotal you will notice many callbacks from sandboxes. A common defense faced by attackers is the use of EDRs that ...
3rd-party
Getting third party C2 channels to work effortlessly with any implant.
Coming Soon! C3 is great but takes too much work to get a new C2 framework to work with it, and hasn’t been fully updated. The included covenant connector do...