Aug 1Behind The Detection — SchtasksPart I: Getting Started — Hello and welcome to this brand new blog series that I'm starting where I’ll be looking at some different techniques/tools used in the wild by different actors from the lens of Sysmon and the Windows Event Log and build/showcase available SIGMA rules to detect them. This post will serve as…Windows7 min read
Jul 29Persistence Using Windows Terminal “Profiles”While doing some research on persistence, I stumbled upon an interesting technique to persist on a windows machine using Windows Terminal profiles. I’ve tweeted about this technique as the method fits in a single tweet 😅 But I decided to formalize everything in a blog so here it goes. Windows Terminal …Windows4 min read
Jun 16Persistence With “Fiddler Classic” ExtensionsInspired by Rasta Mouse blog on Notepad++ Plugins for Persistence this blog talks about how to use Fidder Classic extensions/plugins as a persistence mechanism. First a quick definition from the website: Fiddler Classic and fiddler Everywhere are special-purpose proxy server tools for debugging web traffic from applications like browsers. They’re…Persistence2 min read
Mar 20LOLBINed — 360TotalSecurity (360AdvToolExecutor.exe)Introduction Continuing with the same idea as my last two articles about “F-Secure FSDIAG” and “CyberGhost VPN”, let’s continue our search for LOLBINs in known products. This time I’m taking a look at 360 Total Security Note: This issue has been reported to the 360 Total Security team but no response…Lolbin3 min read
Mar 19LOLBINed — CyberGhost VPN (PeLauncher.exe/Dashboard.exe)Introduction In the same spirit as my last article about “F-Secure FSDIAG”, let’s continue our search for LOLBINs in known products. This time I’m taking a look at CyberGhost VPN Note: Since the CyberGhost team doesn’t have a vulnerability program, I’ve reported this issue to the support team which they forwarded…Lolbin3 min read
Mar 17LOLBINed — F-Secure Support Tool (FSDIAG)Introduction I’ve been doing some “stupid research” recently on a lot of tools in my quest to find LOLBins everywhere. This short blog is about one of those tools called “fsdiag.exe”. Note: This issue has been reported at the start of the year in January 2022 and has been fixed in…Lolbin4 min read
Feb 2Why Hunting For LOLBINs Is One Of The Best BetsIntroduction While working on “Malicious Command-Line”(MAL-CL), documenting and researching the many use cases different tools can be (ab)used via the command line. I noticed a trend that in hindsight seems “obviously obvious” but is I believe worth saying nonetheless. You don’t drop things just because they’re old and dusty, you drop…Lolbin6 min read
Dec 18, 2021Should You Trust Your Admin Tools?Introduction Often time sysadmins are managing multiple servers and machines at once or doing some other shenanigans. So they tend to download and use tools that ease their process. …Pentesting4 min read
Oct 5, 2021Windows 11 “New” ETW Providers — OverviewToday Microsoft started rolling out the newest version of Windows to computers around the world. I wanted to check what new and interesting ETW providers were included in this official release. Note: to get these results I did a diff between providers from windows version 21H1 (Win 10) and 21h2…Etw3 min read
Aug 26, 2021Finding Detection and Forensic Goodness In ETW ProvidersIntroduction Hello and welcome to this follow-up blog on ETW. If you haven't read the first part I highly suggest you do because this will be a direct build-up on the concepts introduced there. (Link below) A Primer On Event Tracing For Windows (ETW) nasbench.medium.com Last time we talked about ETW and its different components. This time I thought I’ll…Etw6 min read
