π [ Tyl0us, Matt Eidelberg ]
Small update to ScareCrow. Shoutout to @mariuszbit for the feature request. Check it out: https://t.co/VIQVnKd2tJ
#netsec #redteam #EDR #evasion
π https://github.com/optiv/ScareCrow
π₯ [ tweet ]
Small update to ScareCrow. Shoutout to @mariuszbit for the feature request. Check it out: https://t.co/VIQVnKd2tJ
#netsec #redteam #EDR #evasion
π https://github.com/optiv/ScareCrow
π₯ [ tweet ]
π1
π [ Tyl0us, Matt Eidelberg ]
New Tool - Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods. Check it out: https://t.co/hjB7aXqVhy
#netsec #redteam #EDR #evasion
π https://github.com/optiv/Freeze
π₯ [ tweet ]
New Tool - Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods. Check it out: https://t.co/hjB7aXqVhy
#netsec #redteam #EDR #evasion
π https://github.com/optiv/Freeze
π₯ [ tweet ]
π [ Tyl0us, Matt Eidelberg ]
ScareCrow 5.0 is out now, a massive rewrite of the framework with huge new features, IoC's removed & new evasion techniques added. If you are curious take a look at the changelog. Check it out: https://t.co/VIQVnKd2tJ #netsec #redteam #EDR #evasion
π https://github.com/optiv/ScareCrow
π₯ [ tweet ]
ScareCrow 5.0 is out now, a massive rewrite of the framework with huge new features, IoC's removed & new evasion techniques added. If you are curious take a look at the changelog. Check it out: https://t.co/VIQVnKd2tJ #netsec #redteam #EDR #evasion
π https://github.com/optiv/ScareCrow
π₯ [ tweet ]
π [ an0n @an0n_r0 ]
playing against an #AV/#EDR: when almost everything failed, finally, loaded @chvancooten's #NimPlant using my custom stager based on @hasherezade's libPeConv and managed to execute what I wanted, #Rubeus with built-in execute-assembly (#AMSI bypass + #ETW block). never give up :)
π₯ [ tweet ]
playing against an #AV/#EDR: when almost everything failed, finally, loaded @chvancooten's #NimPlant using my custom stager based on @hasherezade's libPeConv and managed to execute what I wanted, #Rubeus with built-in execute-assembly (#AMSI bypass + #ETW block). never give up :)
π₯ [ tweet ]
Π° ΠΊΡΠΎ ΡΠ΄Π΅Π»Π°Π»-ΡΠΎ execute-assembly Π° Π° Π°π7π€1
π [ Fabian Bader @fabian_bader ]
π‘οΈWindows Firewall and WFP are only two ways to silence an #EDR agent.
π’In my latest blog post I discuss another network based technique to prevent data ingest and ways to detect it.
π https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/
And if you want even more, checkout part 2 released by @Cyb3rMonk
π₯ [ tweet ]
π‘οΈWindows Firewall and WFP are only two ways to silence an #EDR agent.
π’In my latest blog post I discuss another network based technique to prevent data ingest and ways to detect it.
π https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/
And if you want even more, checkout part 2 released by @Cyb3rMonk
π₯ [ tweet ]
π₯4π1