As of Covenant v0.4, Covenant provides options that allow developers to integrate custom C2 communication protocols into an operation…

In Cobalt Strike, blockdlls was introduced to allow protection of spawned processes from non-Microsoft signed DLL's. In this post I will show just how this works, and look at an additional process security option which could help us to deter endpoint security…

Introduction Remote Desktop is one of the most widely used tools for managing Windows Servers. Admins love using RDP and so do attackers. Often the credentials that are used to...

About Imphash

Halloween has come and gone, and yet NTLM reflection is back from the dead to haunt MSRC once again. This post describes a deceptively simple bug that has existed in Windows for 15 years.

NTLM reflection is still possible through a highly reliable timing…

DNCI - Dot Net Code Injector. Contribute to guibacellar/DNCI development by creating an account on GitHub.

Uncontrolled proliferation of Offensive Security Tools is an unnecessary contribution to real threat actor’s computer network operations.

[...]Read More... from Resources

During red team engagements, lateral movement in a network is crucial. In addition, as a critical part of exploit chains, security solutions put a lot of effort to detect this movement. Techniques such as remote WMI and PsExec are fairly well detected. In…

We write about Windows Internals, Hypervisors, Linux, and Networks.

Last year when I started playing with Azure I looked into Azure AD connect and how it stores its high privilege credentials. When I was revisiting this topic a few weeks ago, it turned out that some things had changed and my previous method of dumping credentials…

As promised in my previous post , I will show you how to exploit the “Printconfig” dll with a real world example. But what does Apple’s iPhone have to do with it?? Well, keep on r…

AV/EDR evasion via direct system calls. Contribute to jthuraisamy/SysWhispers development by creating an account on GitHub.

There are a ton of great resources that have been released in the past few years on a multitude of Kerberos delegation abuse avenues.   Howe...

Mimikatz provides the opportunity to leverage kernel mode functions through the included driver, Mimidrv. Mimidrv is a signed Windows…

Adversary Tactics - PowerShell Training. Contribute to SpecterOps/at-ps development by creating an account on GitHub.

Interacting with Azure, offensively

Explore Kerberos abuse techniques on Linux with our comprehensive guide. Delve into the available tools and methods for effective Kerberos exploitation.