Abusing Group Policy Caching

https://decoder.cloud/2020/09/23/abusing-group-policy-caching

@WindowsHackingLibrary

A different way of abusing Zerologon (CVE-2020-1472)

Using the Printer Bug with zerologon to relay to DSRUAPI and DCSYNC (No password reset needed)

https://dirkjanm.io/a-different-way-of-abusing-zerologon

@WindowsHackingLibrary

Sysmon Internals - From File Delete Event to Kernel Code Execution

https://undev.ninja/sysmon-internals-from-file-delete-event-to-kernel-code-execution

@WindowsHackingLibrary

Evading Static Machine Learning Malware Detection Models – Part 1: The Black-Box Approach

https://blog.compass-security.com/2020/10/evading-static-machine-learning-malware-detection-models-the-black-box-approach

@WindowsHackingLibrary

Powershell Logging: Obfuscation and some New(ish) Bypasses

Part1:
https://www.bc-security.org/post/powershell-logging-obfuscation-and-some-newish-bypasses-part-1

Part2:
https://www.bc-security.org/post/powershell-logging-obfuscation-and-some-newish-bypasses-part-2

@WindowsHackingLibrary

Following Donut Crumbs

https://riccardoancarani.github.io/2020-10-10-donut-crumbs

@WindowsHackingLibrary

Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative

https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative

@WindowsHackingLibrary

Introduction to Threat Intelligence ETW

A quick look into ETW capabilities against malicious API calls.

https://undev.ninja/introduction-to-threat-intelligence-etw

@BlueTeamLibrary

Active Directory (AD) Attacks & Enumeration at the Network Layer

https://www.lares.com/blog/active-directory-ad-attacks-enumeration-at-the-network-layer

@WindowsHackingLibrary

Process Herpaderping:
Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself.

https://jxy-s.github.io/herpaderping

@WindowsHackingLibrary

Using and detecting C2 printer pivoting

https://labs.f-secure.com/blog/print-c2

@WindowsHackingLibrary

Using Custom Covenant Listener Profiles & Grunt Templates to Elude AV

https://offensivedefence.co.uk/posts/covenant-profiles-templates

@WindowsHackingLibrary

WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques

https://www.fireeye.com/blog/threat-research/2020/11/wow64-subsystem-internals-and-hooking-techniques.html

@WindowsHackingLibrary

Windows RpcEptMapper Service Insecure Registry Permissions EoP

https://itm4n.github.io/windows-registry-rpceptmapper-eop

@WindowsHackingLibrary

Purgalicious VBA: Macro Obfuscation With VBA Purging

https://www.fireeye.com/blog/threat-research/2020/11/purgalicious-vba-macro-obfuscation-with-vba-purging.html

@WindowsHackingLibrary

Module Stomping in C#

https://offensivedefence.co.uk/posts/module-stomping

@WindowsHackingLibrary

Gnome is a module to load your signed driver stealthily. The driver is extracted from the Gnome loader, dropped to disk and loaded using NtLoadDriver instead of the usual service creation driver loading which can be noisy and leaves large forensic artefacts behind such as service creation, service start/stop logs etc.

https://github.com/slaeryan/AQUARMOURY/tree/master/Gnome

@WindowsHackingLibrary

Exploiting a “Simple” Vulnerability – In 35 Easy Steps or Less!

https://windows-internals.com/exploiting-a-simple-vulnerability-in-35-easy-steps-or-less

@WindowsHackingLibrary

Forging malicious DOC, undetected by all VirusTotal static engines

https://arielkoren.com/blog/2020/12/24/forging-malicious-doc

@WindowsHackingLibrary

A Modern Exploration of Windows Memory Corruption Exploits - Part I: Stack Overflows

https://www.forrest-orr.net/post/a-modern-exploration-of-windows-memory-corruption-exploits-part-i-stack-overflows

@WindowsHackingLibrary