Full StackOverflow Developer
The Land of Pleasant Living
Joined August 2017
- Tweets 5,659
- Following 421
- Followers 12,338
- Likes 10,352
Pinned Tweet
[Blog] Unmanaged Code Execution with .NET Dynamic PInvoke
(Yes, you read that correctly - "Dynamic P/invoke" as in "Dynamic Platform Invoke")
bohops.com/2022/04/02/unmana…
34
161
3
297
bohops retweeted
Kernel-level callstack visibility is essential for in-memory #ThreatDetection of #Malware and defense evasions, #ElasticSecurityLabs researchers @dez_, @GabrielLandau, and @SBousseaden explain the research behind this capability: go.es.io/42d0Mge
4
47
3
123
Invest in the things that actually matter:
- the needs of your family, dependents, and yourself
- experiences with those who are most important such as family and friends
- the betterment of yourself in whatever drives you and makes you truly happy
Nice car? Trust me barely anybody even looks. It's four wheels, maybe you have a cool color. Nice watch? They assume it's fake.
If you want these things and value them, you have to accept it will mostly just be you who cares. And that should be fine, because it's not for Them.
Show this thread
1
12
@frodosobon 's blog is quite good and very underrated
Check it out 👇
waawaa.github.io/
2
4
13
bohops retweeted
Last week I ported TinyNuke HVNC to a Cobalt Strike BOF: github.com/WKL-Sec/HiddenDes…
10
149
7
415
bohops retweeted
A fun alternative way to find child process execution of a certain process via BAM.
You can use the "HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\<SID>\<Binary>" RegistrySet event to track child process created by a process. #dfir #detection
1
44
2
107
bohops retweeted
I’m excited to kick the morning off by announcing the release of 🍎 Living Off the Orchard: macOS Binaries (LOOBins)!
loobins.io
You can find more details about the LOOBins project in my “Introducing LOOBins” Medium post here:
infosecb.medium.com/introduc…
6
196
11
519
bohops retweeted
And for those with Sentinel/Defender for Endpoint, here's a great example of how we can leverage this project in our queries :)
Oh hell yeah, this is cool!
DeviceNetworkEvents
| where RemoteIPType == "Public"
| where InitiatingProcessVersionInfoOriginalFileName in ((
externaldata ( Name:string ) [ "lolbas-project.github.io/api…" ]
with (format=csv, ignoreFirstRecord=true) | distinct Name
))
#MDE
Show this thread
1
4
15
I've seen a lot of chatter about Living-Off-The-Land (LOL/LOTL) attacks and techniques on the socials this week. For background info, use cases, and offensive/defensive references, the LOLBAS project has you covered:
lolbas-project.github.io/
1
16
1
65
Really cool .NET loader for dynamic invocation and an excellent Yara rule. Great work @dr4k0nia!
I'm joining the dark side, today I'm publishing a malware loader called NixImports. It uses API-Hashing and dynamic invoking to evade static analysis. Check out my blog post for more details: dr4k0nia.github.io/posts/Nix…
Show this thread
2
3
13
bohops retweeted
🔥Updated WDACConfig module. @M_haggis & @nas_bench you can now automatically create a base policy denying all #LOLDrivers and deploy it too if you want.
More info on GitHub: github.com/HotCakeX/Harden-W…
Download from PowerShell gallery (self-updates): powershellgallery.com/packag…
#WDAC
1
11
45
1,519
bohops retweeted
Slides from our Active Directory & DNS (ADIDNS) talk at BSidesCharm 2023 are up.
AD & DNS: A Match Made in Heck
I believe video will be released soon(ish).
Did you happen to miss @dotdotdotHorse & @JimSycurity @BSidesCharm? Well good news, you can view their abstract and download slides for their talk "AD & DNS: A Match Made In Heck" right now on the Trimarc content page.
No registration required. Enjoy!
hub.trimarcsecurity.com/post…
1
14
1
45
bohops retweeted
IcedID Macro Ends in Nokoyawa Ransomware
➡️Initial Access: IcedID XLS Macro
➡️Credentials: LSASS, Creds in Files
➡️Persistence: Scheduled Task
➡️Lateral: RDP, SMB, WMI, WinRM, Psexec
➡️C2: IcedID, Cobalt Strike, VNC
➡️Impact: Nokoyawa Ransomware
thedfirreport.com/2023/05/22…
1/X
2
142
8
269