Red Team

Designing Effective Covert Red Team Attack Infrastructure

Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript

Lateral Movement using Excel.Application and DCOM

Randomized Malleable C2 Profiles Made Easy

Malleable Command and Control (C2) profiles provide red teamers and penetration testers with a wealth of options to modify how Cobalt Strike both appears on the wire and on the compromised host. Malleable C2 can be used to impersonate actual threat actors…

Attack Infrastructure Log Aggregation and Monitoring

WSH Injection: A Case Study

At BSides Nashville 2017, Casey Smith (@SubTee) and I gave a talk titled Windows Operating System Archaeology…

Bypassing AMSI via COM Server Hijacking

Microsoft’s Antimalware Scan Interface (AMSI) was introduced in Windows 10 as a standard…

Phishing Against Protected View

Microsoft Office has a security feature called Protected View. This feature opens an Office document…

“Fileless” UAC Bypass using sdclt.exe

Recently, I published a post on using App Paths with sdclt.exe to bypass UAC. You may…

Bypassing UAC using App Paths

Over the past several months, I’ve taken an interest in Microsoft’s User Account Control (UAC) feature in…