ENDPOINT & ADVERSARY

Endpoint & Adversary Techniques

Endpoint tradecraft, privilege and persistence techniques, and adversary implementation research.

← All categories

NOTE

Note

3

C Dynamic-Link Library Development

Writing a dll Using a def File

PROCEDURE

Procedure

56

Malicious Macro Launches a bat Script Through the Shell Function to Execute Commands

Launching Calculator by Invoking Malicious Macro Code Through Word Template Injection

Creating a Scheduled Task Through Macro Code

Using Bad-PDF to Steal NTLM Hashes from a Windows Host

Exporting Domain Credential Files Through Direct Volume Access with NinjaCopy

Stealing Domain Users' Plaintext Passwords with a Windows Password Filter DLL

Dumping Domain Cached Credentials (mscash) with cachedump

Abusing Security Support Provider (SSP) to Steal Domain Controller User Credentials

Exporting User Credentials from the Proc File System Through MimiPenguin

Obtaining Domain Password Credentials with NtdsAudit

Using C++ to Call ntdll.RtlCompressBuffer to Compress Collected Data

SNMP Service Brute Force and Information Gathering

Testing Target Connectivity with the Test-Connection Function in PowerShell

Collecting Information on windows with powershell and Saving It to the File System as html

Gathering Network Information on windows Systems Through Command Execution

Verifying a User's Working Environment by Counting Files in the Documents Directory

Detecting a Sandbox Environment by Calculating Active Window Titles and Checking a Specific Module

mavinject.exe

Arbitrary Command Execution Using the Mssql sp_procoption Stored Procedure

Injecting Malicious Code into a Legitimate Process Through Process Hollowing and Executing It

Creating a windows Service with powershell

Creating a Scheduled Task with powershell

Achieving Persistence by Adding a Registry Startup Entry with a powershell Script

Maintaining Access by Combining the Windows Screen Saver Feature with MSF

Maintaining Access to a Windows System with a Word WLL Add-In

Maintaining Access by Creating a windows System Service Backdoor with powershell

Maintaining Access by Abusing a systemd Timer to Create a Scheduled Task

Creating a Scheduled Task Through the ITaskService COM Component to Achieve Automatic Startup

Maintaining Access to a Windows System Through DLL Hijacking Combined with MSF

Maintaining Windows Access by Creating a VBS Backdoor with MSF persistence

Setting the Registry Startup Item to calc.exe Through a VBS Script

Maintaining Access by Executing a Backdoor Through Default File Associations

Using the Local APPINFO RPC Service to Bypass Windows UAC and Launch a High-Privilege Application

Bypassing UAC Through Registry Hijacking

Modifying Process Access-Token Privileges with AdjustTokenPrivileges

Disabling UAC by Modifying the Registry

Obtaining a High-Privilege Shell by Hijacking a Binary Used by the 7-Zip Installer

System Privilege Escalation by Obtaining windows Patch Information

Obtaining a Host Shell by Executing a Payload with the Allowlisted Rundll32.exe

Obtaining Shell Access by Executing a Payload with the Allowlisted zipfldr.dll

Abusing MSXSL.EXE to Execute an XSL File for Arbitrary Command Execution

Abusing the WindowsUpdate Program to Execute a Malicious DLL and Obtain Host Access

Abusing the Allowlisted IEexec.exe to Execute a Backdoor and Obtain Host Access

Obtaining Windows System Privileges Through CLR Hijacking Combined with MSF

Side-Loading a Malicious duser.dll Through the Allowlisted rekeywiz.exe to Launch Calculator

Listening on a Specified Port on Windows with PowerShell

Creating a New Directory on a Specified FTP Server Through powershell

Decoding a Server Port from Base64 Multiple Times with PowerShell

Clearing Traces on Windows with a BAT Program

Using powershell to Copy a File to a System Directory and Disguise It as a Normal File

Using mklink to Execute a File's ADS Alternate Data Stream

Stopping the Windows Volume Shadow Copy Service with PowerShell

Setting a File or Directory's Attributes to Hidden with PowerShell

Deleting Disk Volume Shadow Copies Through WMI

Evading Antivirus Detection with ADS Alternate Data Streams

Disabling Office Macro Warnings Through the Registry to Execute Macro Code More Stealthily

ANALYSIS

Analysis

4

MoonBounce the dark side of UEFI firmware

A Game-Cheat Team Launches Cyberattacks Against Employees at Numerous Enterprises

Suspected HADES Group Launches a Military-Themed Attack Against Ukraine

Analysis of Recent Attack Activity by a Suspected Taiwan-Related Group