Has anyone ever seen or used this evasion technique? I have been using it for many years and still find it effective (particularly with macro's), so I was surprised to see it continue to work so I decided to document it on Unprotect : https://unprotect.it/technique... Feedback appreciated!
cf : @fr0gger_
New code snippet added that demonstrates the principle of indirectly copying a buffer to another memory region using the Windows APIs ReadProcessMemory (Example 1) or ReadFile (Example 2): https://unprotect.it/snippet/i...
@DarkCoderSc I've been using it for many years too. Although it depends on the EDR, sometimes “cat -raw payload.txt | iex” is not detectable and iex(cat -raw payload.txt) is. I usually create an alias (such as “cat -raw payload.txt | pwn”) and it's even more effective :)
@JoelGMSec Do you know any public papers that describe this technique?
@DarkCoderSc Have you tested it's effectiveness against the latest EDR updates???
@ancientechcyber It was very effective against those I tested, you can try it yourself on yours ;)
Recently, a colleague encountered a strange situation: an undetermined security product was killing LDAP connections performed by ldap3 (NTLM). A simple bypass was to force SIMPLE authentication (pun intended). I've implemented it in #pywerview. https://github.com/the-useless... 🌻
New blog post and call for collaboration and sharing around "Using NetBIOS names for pivoting and threat clustering" I'm already tracking more than 40 clusters and growing... https://c-apt-ure.blogspot.com...
🆕Recent additions to http://LOLBAS-Project.github.i... • iscsicpl.exe for DLL exec+UAC bypass • eudcedit.exe for UAC bypass • reset.exe/change.exe/query.exe for proxy exec • pixtool.exe/applauncher.exe/mpiexec.exe for dev tool proxy exec ⭐Nearly 8,000 GitHub stars - thank you all!
🔓List of public attacks on BitLocker https://github.com/Wack0/bitlo... 🪛More info about BitPixie: https://neodyme.io/en/blog/bit... If you have an account the easiest way to decrypt is if with the recovery key found at: https://aka.ms/myrecoverykey (personal) https://portal.manage.microsof... (managed devices)