Daragh Vule

Daragh Vule Disclaimer: I didn’t come up with any of the methods or technique

😎
30/06/2023

😎

This post is a replacement for my previous 4-part series. What is AMSI? The Antimalware Scan Interface is a set of Windo...
04/09/2021

This post is a replacement for my previous 4-part series. What is AMSI? The Antimalware Scan Interface is a set of Windows APIs that allows any application to integrate with an antivirus product (assuming that product acts as an AMSI provider). Windows Defender, naturally, acts as an AMSI provider as do many third-party AV solutions.

In the Memory Patching AMSI Bypass post, I discussed how to patch the AmsiScanBuffer function to prevent it from returni...
03/09/2021

In the Memory Patching AMSI Bypass post, I discussed how to patch the AmsiScanBuffer function to prevent it from returning a positive result when scanning content. That process involved: Finding the location of AmsiScanBuffer in memory. Changing the memory permissions to RWX. Copying the patched bytes across. Restoring the memory region back to RX.

This is the first in a short series of posts designed to explore common (remote) process injection techniques and their ...
03/09/2021

This is the first in a short series of posts designed to explore common (remote) process injection techniques and their OPSEC considerations. Each part will introduce a different technique that will address one or more “weaknesses” previously identified. This post will analyse the most classical method of injection – the VirtualAllocEx/WriteProcessMemory/CreateRemoteThread pattern; and assumes the

Cobalt Strike 4.2 introduced a new set of “spawn and tunnel” commands called spunnel and spunnel_local. Shortly after re...
03/09/2021

Cobalt Strike 4.2 introduced a new set of “spawn and tunnel” commands called spunnel and spunnel_local. Shortly after release, Raphael Mudge published a blog post entitled Core Impact and Cobalt Strike Interoperability, in which he details how these can be used to tunnel Core Impact’s agent through Beacon. The CS manual also says the commands

If you’ve any experience with building infrastructure designed to support a red team or adversary simulation exercise, y...
03/09/2021

If you’ve any experience with building infrastructure designed to support a red team or adversary simulation exercise, you’ll have likely come across the Red Team Infrastructure Wiki. If not, it’s a curated collection of resources for creating secure and resilient infrastructure – covering everything from high-level design considerations to step-by-step setup instructions. Just a cursory

In Part 1, we reviewed the very simple VirtualAllocEx/WriteProcessMemory/CreateRemoteThread injection pattern. The two m...
03/09/2021

In Part 1, we reviewed the very simple VirtualAllocEx/WriteProcessMemory/CreateRemoteThread injection pattern. The two major OPSEC concern(s) that it had was both an RX memory region and an executing thread that were not backed by a module on disk. In this part, we’ll fix the “thread” issue by replacing the use of CreateRemoteThread with QueueUserAPC.

Address

Koltsova Ulica , Bld. 23, Appt. 74
Kyiv
433445

Telephone

+380626394568

Website

Alerts

Be the first to know and let us send you an email when Daragh Vule posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category