Posted by jpluimers on 2024/12/16
For my link archive: [Wayback/Archive] Evade Windows Defender Mimikatz detection by patching the amsi.dll | by Nol White Hat | Jul, 2022 | System Weakness
Via: [Wayback/Archive] rootsecdev on Twitter: ““Evade Windows Defender Mimikatz detection by patching the amsi.dll” by Nol White Hat”
–jeroen
Posted in Blue team, Pen Testing, Power User, Red team, Security | Leave a Comment »
Posted by jpluimers on 2024/12/12
Simple (but fully working) code for
NPLogonNotify(). The function obtains logon data, including cleartext password.
[Wayback/Archive] PSBits/PasswordStealing/NPPSpy at master · gtworek/PSBits has been used in the wild since about 2022 (the code is from 2020).
The code is a ~100 line C file resulting in a DLL exporting the NPGetCaps() and NPLogonNotify() functions.
Background/related:
Posted in .NET, Blue team, C, CommandLine, Development, Power User, PowerShell, PowerShell, Red team, Scripting, Security, Software Development, Windows Development | Tagged: NPPSPY | 1 Comment »
Posted by jpluimers on 2024/12/04
Interesting for both red teams and blue teams: [Wayback/Archive] Hijack Libs
This project provides an curated list of DLL Hijacking candidates. A mapping between DLLs and vulnerable executables is kept and can be searched via this website. Additionally, further metadata such as resources provide more context.
Posted in Blue team, Development, Power User, Red team, Security, Software Development, Windows Development | Leave a Comment »
Posted by jpluimers on 2024/08/01
Remember to adapt what you pack and tailor it for each red team training event as the blue team should expect the unexpected. Believable pretext is key.
[Wayback/Archive] jilles.com 🔜 MCH2022 🏳️🌈🏳️⚧️ on Twitter: “Need to pack enough breaking and entering stuff to pull a good show during the RedTeam training but not too much to get arrested on my way to work. Then again, I might pull it off when I put YMCA on in a loop, in case I get pulled over. “
[Wayback/Archive] jilles.com 🔜 MCH2022 🏳️🌈🏳️⚧️ on Twitter: “This will do for now ;-)”
Posted in Blue team, Power User, Red team, Security, Uncategorized | Leave a Comment »
The Wiert Corner - irregular stream of stuff 