I routinely report malware staged on GitHub (they’re pretty responsive). 100% of what I report is observed as part of an attack chain. Rarely - but not never - this involves code from a legitimate author’s repo being pulled into the victim environment by the attacker’s code.

https://twitter.com/pmelson/status/1406467994490970113?s=21

If you’d like to hunt this TTP in your own environment, proxy logs calling out to hXXps://raw.githubusercontent[.]com or hXXps://gist.github[.]com URLs are a good place to start.

https://twitter.com/pmelson/status/1406469120565125123?s=21

Evade AV by deleting your payload before running it.
https://twitter.com/blackmatter23/status/1406370962984030209?s=21
https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack
https://twitter.com/gabriellandau/status/1404835703574482944?s=21

BOF file to use with Cobalt Strike, dumping the credential manager by abusing the SeTrustedCredmanAccess Privilege
https://github.com/jsecu/CredManBOF

Windows Event Log Service will not work https://twitter.com/ch33r10/status/1406634010189651971?s=21 https://twitter.com/sbousseaden/status/1278013896440324096?s=21 https://nasbench.medium.com/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747. https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html. https://twitter.com/blackmatter23/status/1406933164006723584?s=21. https://twitter.com/blackmatter23/status/1407275816761843715?s=21 Deteciton for NEW Phant0m released: https://gist.github.com/Antonlovesdnb/9fdbc3ba157666d095b70b5e9e713106 https://twitter.com/Antonlovesdnb/status/1407352174477201420?s=20

adsisearcher
https://twitter.com/ninjaparanoid/status/1407137264283504640?s=21

Shadow Creds: Abusing Key Trust Account Mapping for Account Takeover

It is possible to add “Key Credentials” to the attribute msDS-KeyCredentialLink of the target user/computer object and then perform Kerberos authentication as that account using PKINIT.
https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab

"the server component (.exe) does not require any special privileges on the server side at all, a low privileged user is also allowed to open virtual channels and proxy over the connection."

https://research.nccgroup.com/2020/05/06/tool-release-socks-over-rdp/

https://0xdarkvortex.dev/tabs/ratelwarroom_features/badgers/ldapsentinel/

https://github.com/shellster/LDAPPER

Change potentially malicious files to open as txt https://gist.github.com/ChuckFrey/7f77df907a53309ca5d30387989ff143. https://twitter.com/redcanary/status/1408485279669882880?s=21

Search for sc.exe changing rights on services with sdset and an ACE like:

(A;;CCDCLCSWRPLORCWDWO;;;x) where x in ('AU','IU','BU','WD')

You might find an elevation of privilege vuln or a sneaky attacker

https://twitter.com/johnlatwc/status/1409559424201498632?s=21

https://github.com/deepinstinct/LsassSilentProcessExit

https://blacklanternsecurity.github.io/2021-06-28-Detecting-LDAP-Reconnaissance/

1-click meterpreter exploit chain with BeEF and AV/AMSI bypass (Article from 6/2020)

Article from 6/2020

https://medium.com/@bluedenkare/1-click-meterpreter-exploit-chain-with-beef-and-av-amsi-bypass-96b0eb61f1b6

https://gist.github.com/gabe31415/fe2a7bd7213739b2bc407ecf0e100f9a

.NET libraries for Windows implementing PInvoke calls to many native Windows APIs with supporting wrappers.

https://nasbench.medium.com/understanding-detecting-c2-frameworks-darkfinger-c2-539c79282a1c

A Red Team Operation Leveraging a zero-day vulnerability in Zoom

https://medium.com/manomano-tech/a-red-team-operation-leveraging-a-zero-day-vulnerability-in-zoom-80f57fb0822e

https://twitter.com/rpargman/status/1412159727862108168?s=21

https://twitter.com/hexacorn/status/1412517463892414469?s=21

https://posts.bluraven.io/hunting-for-phishing-links-using-sysmon-and-kql-e87d1118ce5e

https://twitter.com/johnlatwc/status/1412408658542186501?s=21

New TA402/MOLERATS Malware – Decrypting .NET Reactor Strings

https://www.0ffset.net/reverse-engineering/malware-analysis/molerats-string-decryption/

https://medium.com/tenable-techblog/dont-make-your-soc-blind-to-active-directory-attacks-5-surprising-behaviors-of-windows-audit-272551430721

What is interesting (for me as an author) is pure cmd + nslookup + certutil approach. 100% LOLBin, 0% PowerShell, and what's even more interesting, it's nslookup transfering the data, and certutil works only as decoder. https://github.com/gtworek/PSBits/tree/master/DNS/v2 https://twitter.com/0gtweet/status/1409548040105512968?s=21 https://twitter.com/pmelson/status/1408449122106019841?s=21

Scour is a modern module based AWS exploitation framework written in golang, designed for red team testing and blue team analysis. Scour contains modern techniques that can be used to attack environments or build detections for defense.
https://github.com/grines/scour

https://github.com/nccgroup/exploit_mitigations

https://ahrefs.com/blog/google-advanced-search-operators/

https://0x00sec.org/t/using-search-engines-for-fun-and-bounties/23832

https://gist.github.com/sundowndev/283efaddbcf896ab405488330d1bbc06

Thx to Binni Shah https://twitter.com/binitamshah/status/1413145864126681104?s=21

https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/main/Tools/BloodHound.yaml

https://posts.bluraven.io/threat-hunting-with-data-science-registry-run-keys-9ae329d1ad85

https://twitter.com/pgl/status/1405614755000295427?s=21

https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/

Also consider EID 4697

https://twitter.com/svch0st/status/1413688851877416960?s=21

Resource for blue to understand different kind of attack techniques
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Methodology%20and%20Resources

https://twitter.com/johnlatwc/status/1414570238423691279?s=21

https://www.bc-security.org/post/xls-entanglement/

https://twitter.com/johnlatwc/status/1415295021041979392?s=21

https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence

https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/

https://dropbox.github.io/dbx-career-framework/ic2_security_engineer.html

https://twitter.com/fanimalikhack/status/1415642024875802624?s=21

Shodan:
https://securitytrails.com/blog/top-shodan-dorks

GitHub:
https://securitytrails.com/blog/github-dorks

Google:
https://securitytrails.com/blog/google-hacking-techniques

Beaconator is an aggressor script for Cobalt Strike used to generate a raw stageless shellcode and packing the generated shellcode using PEzor.

https://github.com/capt-meelo/Beaconator

https://raw.githubusercontent.com/OTRF/API-To-Event/master/images/API-to-Sysmon.svg

new coerced authentication primitive, enabled by default on servers and workstations, and even works anonymously against domain controllers 💣 Combine with AD CS relay (ESC8 in posts.specterops.io/certified-pre-…) and you go: anonymous ➡ domain admin! https://twitter.com/cnotin/status/1417863008324407302?s=21 https://twitter.com/wdormann/status/1418576755389083662?s=21 Detection ideas: https://twitter.com/antonlovesdnb/status/1408804802604187655?s=21

https://twitter.com/blackmatter23/status/1418605481766051844?s=21

https://twitter.com/rpargman/status/1419299727376478217?s=21 Following the advice in this blog to look for low-prevalence characters, common substitution characters, or even non-ASCII characters in commands is a great application for #JupyterNotebooks or automation with GlyphHunter: https://github.com/BinaryDefense/glyph-hunter https://twitter.com/wietze/status/1418562387175690242?s=21 https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation https://github.com/wietze/windows-command-line-obfuscation

https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/
https://twitter.com/haus3c/status/1419694896995311619?s=21

https://twitter.com/johnlatwc/status/1419613466407706624?s=21
https://lolbas-project.github.io/lolbas/Binaries/Installutil/

https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/

C++ code resource What are TCHAR, WCHAR, LPSTR, LPWSTR, LPCTSTR (etc.)

https://www.codeproject.com/Articles/76252/What-are-TCHAR-WCHAR-LPSTR-LPWSTR-LPCTSTR-etc

https://twitter.com/binaryz0ne/status/1419829931455000601?s=21

https://rastamouse.me/ntlm-relaying-via-cobalt-strike/

https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575

A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.
https://github.com/bats3c/ADCSPwn

https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/

https://www.thehacker.recipes/active-directory-domain-services/movement/access-control-entries

Python version of the C# tool for "Shadow Credentials" attacks.

https://github.com/ShutdownRepo/pywhisker

Pre-requisites for this attack are as follows

the target Domain Functional Level must be Windows Server 2016 or above.
the target domain must have at least one Domain Controller running Windows Server 2016 or above.
the Domain Controller to use during the attack must have its own certificate and keys (this means either the organization must have AD CS, or a PKI, a CA or something alike).
the attacker must have control over an account able to write the msDs-KeyCredentialLink attribute of the target user or computer account.

BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active…
https://github.com/davidprowe/BadBlood

https://twitter.com/chvancooten/status/1418969800823513093?s=21

https://github.com/ShutdownRepo/targetedKerberoast

https://github.com/klezVirus/inceptor https://twitter.com/klezvirus/status/1422223092605194245?s=21

Spawns a sacrificial process with Arbitrary Code Guard (ACG) to evade EDR hooking, BlockDLL to prevent non-MS DLL's from loading, and PPID spoofing. Then injects & executes shellcode.

https://github.com/boku7/spawn

https://twitter.com/0xboku/status/1421866295646171142?s=21

https://twitter.com/nerdpyle/status/1422626862015029251?s=21

https://techcommunity.microsoft.com/t5/storage-at-microsoft/configure-smb-signing-with-confidence/ba-p/2418102

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/using-computer-name-aliases-in-place-of-dns-cname-records/ba-p/259064

Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process


https://github.com/boku7/HellsGatePPID

https://github.com/mattnotmax/cyberchef-recipes

https://jfmaes-1.gitbook.io/reflection-workshop/

tool(s) for patching/injecting shellcode into MS-Authenticode signed PE files without breaking the signature, used for;

* Bit/Sig Flipping PEs (EXE, DLL, Sys ..etc)
* Encrypt/Inject shellcode into PEs
* Decrypt/Load shell code from modified but still signed PE files.

https://twitter.com/med0x2e/status/1424441793811259395?s=21

https://github.com/med0x2e/SigFlip

https://posts.bluraven.io/detecting-threats-with-process-tree-analysis-without-machine-learning-838d85f78b2c

https://twitter.com/antonlovesdnb/status/1425824113281703936?s=21

https://wumb0.in/extracting-and-diffing-ms-patches-in-2020.html

https://github.com/ThreatHuntingProject/ThreatHunting/tree/master/hunts

https://twitter.com/sbousseaden/status/1428357499292315661?s=21

https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES

https://twitter.com/vk_intel/status/1428384238819323913?s=21

Red Teaming Tip from Conti/Coba Logs:

❔"Safe" to dump NTDS.dit from domain?

...vssadmin list shadows...

🛡️shell wmic /node:"DC01" /user:"DOMAIN\admin" /password:"PASS" process call create "cmd /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy[0-9]\Windows\NTDS\NTDS.dit

https://github.com/googleprojectzero/Jackalope

https://twitter.com/tihanyinorbert/status/1428790212210069508?s=21

https://github.com/mxm0z/awesome-intelligence-writing

https://medium.com/mii-cybersec/malicious-powershell-deobfuscation-using-cyberchef-dfb9faff29f

https://github.com/gh0x0st/Invoke-PSObfuscation/blob/main/layer-0-obfuscation.md

Conti TTP’s using Atomic Red Team and Detection Lab & C2 Infrastructure Hunting

https://michaelkoczwara.medium.com/conti-ttps-using-atomic-red-team-and-detection-lab-c2-infrastructure-hunting-16d159fe0ed8

An Alternative Way of Using MITRE ATT&CK® for Threat Hunting and Detection

https://posts.bluraven.io/an-alternative-way-of-using-mitre-att-ck-for-threat-hunting-and-detection-be55739dc7aa

https://cerbersec.com/2021/08/26/beacon-object-files-part-1.html

https://twitter.com/_sn0ww/status/1431295333644980232?s=21

https://github.com/bohops/UltimateWDACBypassList

https://synzack.github.io/Blinding-EDR-On-Windows/

https://posts.bluraven.io/detecting-edr-bypass-malicious-drivers-kernel-callbacks-f5e6bf8f7481

#threathunting tip, look for explorer.exe with cmdline containing common executable extensions (.vbs, .hta, .ps1 etc.)

https://twitter.com/sbousseaden/status/1433037382224392196?s=21

https://michaelkoczwara.medium.com/cobalt-strike-powershell-payload-analysis-eecf74b3c2f7

https://posts.bluraven.io/threat-hunting-and-detection-with-web-proxy-logs-58094cae3537

https://twitter.com/wietze/status/1433520106194145311?s=21

https://blog.nviso.eu/2021/09/02/anatomy-and-disruption-of-metasploit-shellcode/

https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2

Free,Open-Source,Cross-platform agent and Post-exploiton tool written in Golang and C++, the architecture and usage like Cobalt Strike

https://github.com/geemion/Khepri

https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90

https://0xinfection.github.io/posts/wmi-registry-part-3/

https://github.com/cipher387/Dorks-collections-list

https://twitter.com/sbousseaden/status/1442824222775128069?s=21