Detection Archives | Page 2 of 3

Detecting known DLL hijacking and named pipe token impersonation attacks with Sysmon

by xnand | Nov 13, 2020 | Detection, Jumpsec, Research

Recently we posted a bunch of advisories relating to Ivanti Unified Endpoint Manager, a couple of which are for vulnerabilities which can be used to achieve local privilege escalation. We will give a brief explanation of the vulnerabilities and an example of Sysmon configuration rules to log exploitation attempts, along with the rationale behind them so you can adapt them to your existing configuration if needed.

shad0w

by bats3c | Jun 3, 2020 | Detection, Exploitation

Post exploitation is large part of a red team engagement. While many organisations begin to mature and start to deploy a range of sophisticated Endpoint Detection & Response solutions (EDR) onto their networks, it requires us, as attackers to also mature. We need to upgrade our arsenal to give us the capabilities to successfully operate on their networks. That is why today, I am releasing shad0w.

shad0w is a post exploitation framework which is designed to operate covertly on such networks, providing the operator with much greater control over their engagements. Over future blog posts I will go into greater detail on the intricacies of how shad0w works. This blog post will, therefore, serve as an introduction into the usage and features that shad0w has to offer.

A Defender’s Guide For Rootkit Detection: Episode 1 – Kernel Drivers

by rootkid8 | Apr 20, 2020 | Detection, Exploitation, Jumpsec

Recently JUMPSEC’s youngest red team researcher @_batsec_ raised the bar once more using rootkit techniques to universally evade Sysmon.

Bypassing Antivirus with Golang – Gopher it!

by warden | Jun 20, 2019 | Detection, Jumpsec

In this blog post, we’re going to detail a cool little trick we came across on how to bypass most antivirus products to get a Metepreter reverse shell on a target host. This all started when we came across a Github repository written in Golang, which on execution could inject shellcode into running processes. By simply generating a payload with msfvenom we tested it and found that it was easily detected by Windows Defender. The Meterpreter payload was generated as follows: msfvenom -p...

Enhanced logging to detect common attacks on Active Directory– Part 1

by bugsbunny | Feb 6, 2019 | Detection, Jumpsec

In this blog post I am going to tackle the topic of detecting common attacks using Active Directory logs. It is important to understand the power of data in InfoSec world. Too much data means you’ll be spending rest of the week digging through millions of log entries to try and figure out what the adversary was up to. You can set filters to help you through this, however it can get computationally expensive very fast depending on how your filters operate. It also requires you to know what to...

JUMPSEC LABS

Detecting known DLL hijacking and named pipe token impersonation attacks with Sysmon

shad0w

A Defender’s Guide For Rootkit Detection: Episode 1 – Kernel Drivers

Bypassing Antivirus with Golang – Gopher it!

[Latest Posts]

[Categories]

GitHub

Follow JumpsecLabs

Disclaimer