Wietze

Can LNK files ever be trusted? ⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces a tool to create your own LNKs, and a tool to detected spoofed ones yourself. 🐬 www.wietzebeukema.nl/blog/trust-m...

🔥 Recent additions to lolbas-project.github.io: • applaunch.exe for applocker bypass • mscopilot/setupupc/dotnet-trace.exe for proxy execution • scp/ssh.exe for loading arbitrary DLLs • msoxmled.exe for downloading • fsutil.exe for preventing Windows Defender updates

🫯 New entry added to the #LOLBAS Project: Proxy execution via system-native scp.exe. Takes any remote destination, doesn't actually have to run an SSH server. 👉 lolbas-project.github.io/lolbas/Binar... Thanks @BinFault

wow I set Windows to British English and everything looks different

HijackLibs.net just got a visual refresh 🌟 Explore 600+ documented DLL Hijacking cases, including: • JSON/CSV/YAML feeds • Sigma detection content for every DLL • A single Sigma rule covering all DLLs Check it out: hijacklibs.net

🆕 Recent additions to LOLBAS-Project.github.io: • sigverif/odbcad32.exe for UAC bypass via GUI • IntelliTrace/dxcap/logger.exe for proxy execution • cmstp.exe for loading arbitrary DLLs • cipher.exe for impairing defences ⭐ Nearly 8,500 GitHub stars - thank you all!

🔥 macOS cmd-obfuscation with ArgFuscator New: over 60 os-native macOS binaries' command lines can now be obfuscated using #ArgFuscator, bypassing command-line based detections, such as this EDR trying to prevent credential dumping. 👉 Check it out: argfuscator.net

TIL from @wietzebeukema.nl 🤯

Video demo to play with ArgFuscator -- the super cool research and utility from @Wietze to obfuscate command-lines to try and evade AV or EDR detection 😎 And to test your rules if any of these crazy looking commands fly under the radar! youtu.be/6-Gbv0h7m1I

As June comes to an end, so does #HuntingTipOfTheDay. I hope you enjoyed them! 👉 Find all of them here: bsky.app/search?q=fro...

#HuntingTipOfTheDay: you know how to spot/decode Base64 or XOR in PowerShell… but what about SecureString? This AES-based encryption is native to PowerShell; attackers have been seen to use this for PowerShell obfuscation. 🔍 Hunt for known SecureString decoding commands

#HuntingTipOfTheDay: Stuck in vi/vim? Open a reverse shell to exit remotely 🙃 Not just a joke - you can make vi/vim run arbitrary commands, not all methods to do so are well detected. 🔍 Hunt for child processes of vi(m), especially those that are rare in your environment.

#HuntingTipOfTheDay: there are numerous open-source projects listing cyber threats. Some of these have directly ingestible indicators, which can be very helpful when threat hunting. How about: 🔵 lots-project.com + LOLBINs 🟠 hijacklibs.net + DLL write events 🟢 lolrmm.io + DNS requests

#HuntingTipOfTheDay: AppleScript via osascript is still a popular way for infostealers to get credentials/escalate access. Although some (poorly coded) updaters use this ""legitimately"", hunting for osascript referencing password dialogs might surface behaviour of interest.

#HuntingTipOfTheDay: USB worms are still a thing - often the initial infection happens when a user clicks a malicious shortcut on a USB device. See if you can correlate executions with .LNK files on remote drives to find possible badness.

#HuntingTipOfTheDay: proxy execution via ComputerDefaults.exe by setting this registry key; as it auto-elevates, it also allows for UAC bypass (!). 🔴 Executing parent is usually explorer.exe, making detection harder 🔍 Hunt for reg changes to this key 👉 lolbas-project.github.io/lolbas/Binar...

#HuntingTipOfTheDay: Florian is right. 🌩️ Cloud creds often linger in Environment Variables, especially on servers/dev machines 🟠 One compromised endpoint could thus lead to a full cloud breach 🔍 Hunt for exposed tokens - if you can see it, so could an attacker (well, kinda)

#HuntingTipOfTheDay: Oddvar Moe of @trustedsec.com shows how you can run a full C2 implant from Outlook - just setting a few registry keys does the trick. Any activity concerning these registry keys should be consider suspicious. Full story here: youtu.be/7MDHhavM5GM

#ThreatHuntingTipOfTheDay: rundll32 can be abused in many ways lolbas-project.github.io#t1218.011 Instead of exports, ordinals can be used too. You could hunt for known bad ones, but are ordinals used legitimately that often at all? Look for rundll32 with # on the command line to find out

#HuntingTipOfTheDay: a personal favourite, command-line obfuscation. Substituting or inserting special Unicode characters might allow attackers to bypass string-based detections. Look for command lines with unusual Unicode characters. Checkout ArgFuscator.net for more fun!

#HuntingTipOfTheDay: macOS has a built-in SSH mechanism that is disabled by default. Would you detect it if someone enables it and logs in remotely? Look for remote login events, and investigate the associated session.

#HuntingTipOfTheDay: explorer.exe /root,"c:/your/executable.exe" will spawn your exe from the main explorer.exe, not a new one. This breaks normal process chains. Hunt for explorer.exe with "/root", as well as explorer spawning unusual children (e.g. rundll32, mshta, powershell).

#HuntingTipOfTheDay: a common way to execute malicious code on Linux is to download a script via curl/wget and pipe the result into a shell process like bash. Hunt for curl/wget executions followed by an interactive shell within seconds, both having the same parent process.

#HuntingTipOfTheDay: You have probably heard of .bash_profile and .zshrc, but are you familiar with PowerShell's version of it? Attackers might use this for persistence; monitor modifications of profiles by unexpected processes, and analyse existing files for anomalies.

#ThreatHuntingTipOfTheDay: Malicious DMGs/PKGs are currently the most popular way for macOS infostealers to get foothold. Use macOS’s kMDItemWhereFroms extended attribute to see origins of downloaded DMG/PKGs; investigate ones that are rare across your IT estate.

HijackLibs.net details hundreds of publicly disclosed DLL Hijacking opportunities. With over 700 stars on GitHub and a growing list, @wietzebeukema.nl does an amazing job maintaining it. Despite this contributing can be time consuming. That's why I've created HijackLibs Helper!👇

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections. My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees. Here’s what I found and why it matters 👉 wietze.github.io/blog/bypassi...

DLL hijacking with the native and built-in Windows utility Dism.exe -- simple MessageBox and obligatory reverse shell demo, then some handy penetration testing resources for tricks and opportunities with other programs :) youtu.be/uY8BpZBF2f0

Thanks to @cyberbuff (https://buff.ly/40VgTAs) you can now leverage ArgFuscator.net's contents via Invoke-ArgFuscator. Simply install the latest version from the PowerShell Gallery and use '-Command' to specify any of the supported commands (https://buff.ly/4hKMjRq). 🤘 https://buff.ly/4b7uwBo

🚀 Today I'm launching ArgFuscator: an open-source platform documenting command-line obfuscation tricks AND letting you generate your own 🔥 68 commonly used executables supported out of the box - use right away, make tweaks, or create your own config 👉 Now available at argfuscator.net

#LOLBAS project update: Entries now have placeholders for paths, URLs, and more. This makes it easier to visually see what parts are "variable", and for LOLBAS API users (lolbas-project.github.io/api/) it'll be easier to use with automation. Check it out: ⭐ lolbas-project.github.io