malmoeb.bsky.social

“Crucially, this service is configured with Before=sysinit[].target, ensuring the rootkit executes on every system boot prior to the initialization of any security tooling.” [1] This is an interesting approach, but it may be worded too generically.

The rootkit is using insmod to load the malicious module, and the module itself resides on disk. Plus, after loading, you face various rootkit detection techniques. Loading it before any EDR / security tooling might be the easier part of the whole "stealth" journey.

“Crucially, this service is configured with Before=sysinit[].target, ensuring the rootkit executes on every system boot prior to the initialization of any security tooling.” [1] This is an interesting approach, but it may be worded too generically.

if an EDR only attaches its eBPF programs, kprobes, tracepoints, or other telemetry after its userspace service starts, the rootkit may already have loaded and established its hooks by then.

“Crucially, this service is configured with Before=sysinit[].target, ensuring the rootkit executes on every system boot prior to the initialization of any security tooling.” [1] This is an interesting approach, but it may be worded too generically.

This GPO-based “ransomware without ransomware” technique is pretty cool: abuse trusted Group Policy to deliver the impact, without ever dropping an encryptor on Windows endpoints.

But there is something amusing about framing “traditional ransomware detection wouldn’t catch this” as the big defensive challenge. By the time an attacker has domain-admin-equivalent privileges, can create and link GPOs at the domain root, turn off the firewall domain-wide, and exfiltrate data,

MacSync's iCloud Calendar trick is pretty cool. One MacSync downloader analyzed by Securelist contains a URL such as: https://caldav.icloud[.]com/published/... It retrieves a public .ics calendar, creates an anonymous pipe, launches zsh -s, sets the pipe as stdin, and feeds it into it line by line.

Those commands then download the next stage, again from iCloud. So, effectively, a public iCloud Calendar is being used as a trusted-hosted shell-script carrier.

MacSync's iCloud Calendar trick is pretty cool. One MacSync downloader analyzed by Securelist contains a URL such as: https://caldav.icloud[.]com/published/... It retrieves a public .ics calendar, creates an anonymous pipe, launches zsh -s, sets the pipe as stdin, and feeds it into it line by line.

On a recent Incident response case, we encountered VMkatz. "It extracts Windows secrets - NTLM hashes, DPAPI master keys, Kerberos tickets, cached domain credentials, LSA secrets, NTDS.dit, BitLocker keys - directly from VM memory snapshots and virtual disks, on the NAS, the hypervisor.." [1]

Set-MpPreference -DisableRealtimeMonitoring $true Add-MpPreference -ExclusionPath "C:\" And then pointing it to a directory, "and let it find everything", as pointed out in the documentation. ./vmkatz.exe C:\ClusterStorage\CSV01\node-002\

On a recent Incident response case, we encountered VMkatz. "It extracts Windows secrets - NTLM hashes, DPAPI master keys, Kerberos tickets, cached domain credentials, LSA secrets, NTDS.dit, BitLocker keys - directly from VM memory snapshots and virtual disks, on the NAS, the hypervisor.." [1]

After a bit of tinkering, I was able to replicate the Google Docs attack vector described in the Huntress blog post [1] Attackers can use Google’s “App Scripts” feature (in Docs) to create a clever pretext. Essentially, the attack works as follows:

What’s particularly interesting about this vector is that the victim remains entirely on docs.google.com throughout the process. This makes the process appear significantly more trustworthy than a classic phishing page on a third-party domain.

After a bit of tinkering, I was able to replicate the Google Docs attack vector described in the Huntress blog post [1] Attackers can use Google’s “App Scripts” feature (in Docs) to create a clever pretext. Essentially, the attack works as follows:

This sidebar mimicked a “Document Decryption” feature and awaited an “Access Key” sent separately by the attacker. The decryption was designed to fail intentionally.

After a bit of tinkering, I was able to replicate the Google Docs attack vector described in the Huntress blog post [1] Attackers can use Google’s “App Scripts” feature (in Docs) to create a clever pretext. Essentially, the attack works as follows:

In a recent ISC SANS Diary, Xavier Mertens 🇧🇪 discussed a malicious ZIP archive that led to Remcos, a pretty common RAT. As Xavier noted, "Most of the files used in this infection path remain undetected by most AVs." [1]

PowerShell, AppData, Dynamic DNS, and Run Key as a persistence mechanism. Four of the eight areas I covered in my first blog post, N-IOCs to Rule Them All [2]. The information presented remains relevant, and finding such infections is not that hard, even if they might bypass AV rules and signatures.

I created two blog posts based on my Fantastic Cleartext Passwords talk, which I presented last year at BSides Munich, and I released the first part (Linux) today. The second part (Windows) will be released next week.

Dumping LSASS to a file named lsass.dmp is not exactly stealthy tradecraft anymore. However, I was reading the analysis of the BravoX ransomware group from my colleague Florian Scheiber, and he writes:

A memory dump of the lsass.exe process (lsass.dmp) was created on a server, hardly a subtle move, but when there is no one watching, there is no judge. [1] I checked our case data, and this is more common than one might assume 🫣.

One of our pentesters was tasked with assessing a customer's perimeter and found an exposed FTP server. They queried the server's FQDN on a specialized service and (surprisingly?) found leaked login credentials.

One set worked. Upon logging in, they discovered dozens of webshells! Someone had clearly found these leaked credentials before we did and tried to exploit the server. The first sign of exploitation dates back to 2024, although the credentials had already leaked in 2022.