modexp @modexpblog

All opinions expressed here are mine only (not of my employer etc). Developer @MDSecLabs

modexp.wordpress.com/
Joined May 2020
  • Tweets 1,440
  • Following 451
  • Followers 3,964
6 Photos and videos
modexp retweeted
Virus Bulletin @virusbtn
Jun 2
SonicWall researchers recently observed a new variant of GuLoader. They look at unpacking its shellcodes, a new anti-debug technique it deploys, and its custom Vectored Exception Handler. securitynews.sonicwall.com/x…
6
44
1
84
modexp retweeted
Samir @SBousseaden
Jun 1
file copy is usually logged as a file creation by EDR/sysmon, using call stack helps target this behv, coupled with DLL sideload (same dir) & the copied PE is MS signed is a use case always wanted to try, ex of matches (UAC bypass & WerFault sideload): github.com/elastic/protectio…
1
24
2
93
Hundreds of models of Gigabyte motherboards, used in gaming and other high-performance computers, have a backdoor in their firmware that invisibly downloads code to the machine at startup—and does so insecurely, leaving the feature open to abuse. wired.com/story/gigabyte-mot…

Millions of PC Motherboards Were Sold With a Firmware Backdoor

Hidden code in hundreds of models of Gigabyte motherboards invisibly and insecurely downloads programs—a feature ripe for abuse, researchers say.

wired.com
16
269
32
541
modexp retweeted
Kurosh Dabbagh @_Kudaes_
May 30
New process injection technique through entry points hijacking. - Threadless or threaded, at will. - No hooking. - No RWX memory permissions. - No new threads with start address pointing to the injected shellcode. github.com/Kudaes/EPI

GitHub - Kudaes/EPI: Process injection technique through entry points hijacking.

Process injection technique through entry points hijacking. - GitHub - Kudaes/EPI: Process injection technique through entry points hijacking.

github.com
8
173
3
453
Clever ‘File Archiver In The Browser’ phishing trick uses ZIP domains - @LawrenceAbrams bleepingcomputer.com/news/se…

Clever ‘File Archiver In The Browser’ phishing trick uses ZIP domains

A new 'File Archivers in the Browser' phishing kit abuses ZIP domains by displaying fake WinRAR or Windows File Explorer windows in the browser to convince users to launch malicious files.

bleepingcomputer.com
7
98
11
223
modexp retweeted
Erwan Grelet @ergrelet
May 28
WinDiff - Browse and compare exports, debug symbols and debug types of PEs between Windows versions. WinDiff is a streamlined revamp of ntdiff, wired directly to Winbindex to fetch Windows updates and PEs automatically. App: windiff.vercel.app Repo: github.com/ergrelet/windiff
4
129
1
425
Akamai researchers have identified 3 vulnerabilities in MS-RPC runtime, all with a base score of 8.1. In our latest blogpost, see how an integer overflow in a dynamic array can lead to RCE in the RPC runtime. Write-up: akamai.com/blog/security-res…
2
123
7
379
Show this thread
modexp retweeted
V2 @ZeroMemoryEx
May 26
Tired by EDRs and AVs continuously flagging your executables? This program terminates protected anti-malware processes by exploiting the GMER driver github.com/ZeroMemoryEx/Blac…

GitHub - ZeroMemoryEx/Blackout: kill anti-malware protected processes (BYOVD)

kill anti-malware protected processes (BYOVD). Contribute to ZeroMemoryEx/Blackout development by creating an account on GitHub.

github.com
7
171
8
532
Replying to @LKing913
trendmicro.com/en_us/researc…

Attack on Security Titans: Earth Longzhi Returns With New Tricks

trendmicro.com
1
4
10
modexp retweeted
Laurent Cheylus @lcheylus
May 25
SectorC: a C Compiler written in x86-16 assembly that fits within the 512 byte boot sector of an x86 machine. In a base64 encoding, it looks like this: xorvoid.com/sectorc.html
36
347
34
1,501
modexp retweeted
Will @BushidoToken
May 24
New Blog - Unmasking Ransomware Using Stylometric Analysis: Shadow, 8BASE, Rancoz A useful CTI trick that can be used much further than for just ransom note comparison, but hopefully it illustrates the potential of Stylometric Analysis! 🔗 blog.bushidotoken.net/2023/0… #CTI
3
57
4
180
170 of the loldrivers.io drivers load with the most recent HVCI driver blocklist. Do with this information what you will.
8
92
2
365
"A 64-bit mode-only architecture removes some older appendages of the architecture, reducing the overall complexity of the software and hardware architecture." intel.com/content/www/us/en/… #iamintel

Envisioning a Simplified Intel Architecture for the Future

PC computing rests heavily on Intel Architecture processors with an enormous installed base, and cloud computing is synonymous with Intel Architecture.

intel.com
5
49
8
122
modexp retweeted
Connor McGarr @33y0re
May 20
Awhile ago I got inspired by my good friend @yarden_shafir's blog post on RE'ing Export Address Filtering (windows-internals.com/an-exe…). Here is a rough POC I put together of my implementation of this, called EATGuard, which analyzes access to kernel32's EAT: github.com/connormcgarr/EATG…

GitHub - connormcgarr/EATGuard: Implementation of an export address table protection mitigation,...

Implementation of an export address table protection mitigation, like Export Address Filtering (EAF) - GitHub - connormcgarr/EATGuard: Implementation of an export address table protection mitigatio...

github.com
3
58
155
modexp retweeted
Daniel Lemire @lemire
May 20
Intel wants to go full 64 bits and drop legacy modes… cdrdv2-public.intel.com/7766…
24
77
16
432
modexp retweeted
Itay Cohen🌱 @megabeets_
May 16
The implant, named "Horse Shell", provides attackers with remote shell access, file transfer abilities, and tunneling capabilities. Although compiled for MIPS, it is meticulously designed to be firmware-agnostic, indicating potential use in various vendors. >>
1
4
19
Show this thread
modexp retweeted
Daniel Gross @danielgross
May 16
Microsoft open-sources a new AI library that connects to open-source GPTs, not just OpenAI. github.com/microsoft/guidanc…
20
175
12
805
modexp retweeted
Virus Bulletin @virusbtn
May 17
Checkpoint researchers have discovered & analysed a malicious firmware implant tailored for TP-Link routers, used in campaigns linked to Chinese APT group Camaro Dragon. The Horse Shell router implant provides remote shell, file transfer & SOCKS tunneling research.checkpoint.com/2023…
1
16
1
37
Show this thread
modexp retweeted
thefLink @thefLinkk
May 15
Here is a little ETW based tool to play with different IOCs by ImageLoad events. I feel like proxying Kernel32!LoadLibrary through Ntdll is a very strong IOC. :-) github.com/thefLink/Hunt-Wei…

GitHub - thefLink/Hunt-Weird-ImageLoads: Small tool to play with IOCs caused by Imageload events

Small tool to play with IOCs caused by Imageload events - GitHub - thefLink/Hunt-Weird-ImageLoads: Small tool to play with IOCs caused by Imageload events

github.com
36
100
modexp retweeted
Trail of Bits @trailofbits
May 15
Excited to have several of our engineers @offensive_con this week! Among them will be @yarden_shafir, who gives us an intro to Windows Notification Facility's (WNF) Code Integrity features in our latest blog post. blog.trailofbits.com/2023/05…
1
27
1
80
Load more