I noticed an interesting change starting from Windows 11 22H2 in the behavior of NtSystemDebugControl when taking a live kernel dump (SysDbgGetLiveKernelDump) including user-mode pages (flag IncludeUserSpaceMemoryPages).

Until Windows 11 21H2 code in nt!DbgkCaptureLiveKernelDump…

The art of artifact collection and hoarding for the sake of forensic exclusivity...

hexacorn.com/blog/2024/05/0…

#DFIR

I published a step by step guide on using Windows event logs to hunt for malware trying to steal sensitive data from browsers e.g. cookies, passwords etc. security.googleblog.com/2024/04/detect… #DFIR Hope it's useful!

AI will conquer the world....

Right....

Upload malicious .curlrc to directory app runs from

Hit page that calls curl

Curl loads .curlrc file in current dir

Pop shell

Only now discovered Spy x Family
This is as good as Aggretsuko (+far less serious)

TIL about audit-logs.tax by Daniel Stinson.

A license (metadata) to kill (for)...

hexacorn.com/blog/2024/04/2…

#DFIR

Dropping a new initial access technique via RDP that I dubbed 'Rogue RDP'. Use malicious .RDP files to bypass email/servers/security gateways and then run code to binary plant/exfil from your own RDP server, blinding EDR. Bonus: Target runs HyperV? RCE! blackhillsinfosec.com/rogue-rdp-revi…

Excelling at Excel, Part 4

hexacorn.com/blog/2024/04/2…

Come join the hunt! Looking for a Senior threat Hunter in the UK
careers.dragos.com/jobs/2059?lang…

Released a new version of OleViewDotNet (v1.14) on the PS gallery. A big change is better source code formatting for proxies and typelibs in IDL format rather than the old pseudo C# one. The video below also shows an example of dynamic parsing and display of source in the UI.

smart as always from Cory Doctorow NONCONSENSUAL BLUE TICK on how closed platforms and social media companies screw over everyone, not just their users

pluralistic.net/2024/04/22/kar…

oh Linkedin, thank you, thank you, I feel so special. can't wait to start pR0Duc1ing 1nfl00ential C0nTenT for you for fr33

Did you know that LSASS has the ability to execute arbitrary kernel-mode addresses? I wrote a small proof of concept that allows administrators to execute unsigned code in the kernel if LSA Protection is disabled.

github.com/floesen/KExecDD

So j00ru//vx published two posts on Windows Registry; given that there were a lot of fixes in Windows Registry in recent months I expect these to be fun ;)
googleprojectzero.blogspot.com/2024/04/the-wi…
googleprojectzero.blogspot.com/2024/04/the-wi…