Evading Sysmon DNS Monitoring

In a recent update to Sysmon [https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon], a new feature was introduced allowing the ability to log DNS events. While this gives an excellent datapoint for defenders (shout out to the SysInternals team for continuing to provide and support these awesome tools for free), for us as attackers, this means that should our implant or payloads attempt to communicate via DNS, BlueTeam have a potential way to pick up on indicators which could lead to de... Read More »

Exploring Mimikatz - Part 2 - SSP

If you haven't had a chance to check it out, take a look here. Continuing on, in this post we will review what has become a nice way of subverting security controls added by Microsoft to prevent dumping of credentials, as well as extracting credentials as they are provided by a victim.... Read More »

Exploring Mimikatz - Part 1 - WDigest

We’ve packed it, we’ve wrapped it, we’ve injected it and powershell’d it, and now we've settled on feeding it a memory dump, and still Mimikatz remains the tool of choice when extracting credentials from lsass on Windows systems. Of course this is due to the fact that with each new security control introduced by Microsoft, GentilKiwi [https://twitter.com/gentilkiwi] always has a trick or two up his sleeve. If you have ever looked at the effort that goes into Mimikatz, this is no easy task, with ... Read More »

Silencing Cylance: A Case Study in Modern EDRs

In this blog post we will explore some of our findings that might assist red teamers operating in environments where CylancePROTECT is in place and briefly touch on CylanceOPTICS, a complementary solution that provides rule based detection to the endpoint.... Read More »

Building, Modifying, and Packing with Azure DevOps

In this post I will be showing how to build a Azure DevOps pipeline for .NET projects, and hopefully show some techniques which I have found useful to modify build artifacts to make them a bit different, and in some cases, to increase the time it takes to analyse our tools if detected by Blue Team.... Read More »