Ｓｅｃ Ｎｏｔｅ

wanna detect DGA domains?

#c2

China APT targets Serbian Government

#APT

OWA Pentest Guide

В статье разобраны все основные атаки и уязвимости OWA и MS Exchange:

• OSINT
• Password spraying
• GAL/OAB
• Архитектура работы
• ZDI-CAN-22101
• OWA CAP Bypass
• CVE-2020-0688
• ProxyLogon
• CVE-2021-26855 - Pre-auth SSRF
• CVE-2021-27065 - Post-auth Arbitrary-File-Write
• ProxyOracle
• CVE-2021-31196 - The Padding Oracle
• CVE-2021-31195 - XSS
• Обход HttpOnly
• ProxyShell
• CVE-2021-34473 - Pre-auth Path Confusion leads to ACL Bypass
• CVE-2021-34523 - Exchange PowerShell Backend Elevation-of-Privilege
• CVE-2021-31207 - Post-auth Arbitrary-File-Write
• ProxyNotShell
• ProxyRelay
• Relay атаки

Thx: @pentestnotes

Do we have to say goodbye to DLL hijacking?

#ml

ANALYZING WINPMEM DRIVER VULNERABILITIES

https://static.ernw.de/whitepaper/ERNW_White_Paper_73-Analyzing_WinpMem_Driver_Vulnerabilities_1.0_signed.pdf

Bypassing Enrollment Restrictions to Break BYOD Barriers in Intune (bring your own device)

Ways of device ownership spoofing and more for persistent access to Intune

This byod is not that byod😅

NET R&D Digest (September, 2025)
Oleg Karasik .NET R&D Digest October 3, 2025 6 Minutes

The summer is over, September is left behind and .NET 10 is coming closer and closer (in fact, it is so close that Stephen Toub has already published his amazing “Performance Improvements in .NET 10” novel), which means it is just about time to read something new about the upcoming release (for instance, the great “Exploring the .NET 10 preview” series by Andrew Lock).

However, if, by any chance, you are interested in something besides .NET 10, then this issue of .NET R&D Digest is here to provide you with various bits of software development 🙂

This issue includes bits of AI, software development, learning, C#, performance, security, C, programming languages, ruby, and of course .NET and .NET Internals.

#guide

Game Hacking - Valve Anti-Cheat (VAC)

#gh

Recent additions to LOLBAS-Project.github.io:

• iscsicpl.exe for DLL exec+UAC bypass
• eudcedit.exe for UAC bypass
• reset.exe/change.exe/query.exe for proxy exec
• pixtool.exe/applauncher.exe/mpiexec.exe for dev tool proxy exec

How to kill AV/EDR (of different kinds) with a couple of clicks

Requirements:
- Admin rights on the machine;
- Ability to deliver procmon.
And then everything is more than straightforward.

1. Enable the "EnableBootLogging" feature;
2. Create a symbolic link:
mklink C:\Windows\Procmon.pmb "<Full path to the file that needs to be overwritten>"
3. Reboot the machine.

Magic happens.

More details:
https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html

New LockBit 5.0 Targets Windows, Linux, ESXi

LockBit 5.0 Ransomware – Analysis, How It Works, and What to Do If You’re Hit

#lockbit

Through the Cortex XDR Lens: Uncovering a New Activity Group Targeting Governments in the Middle East and Africa

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

#Chinese #APT

Всем привет!

Делюсь презентацией с Underconf :)) запись будет чуть позже

From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944

Mandiant

#APT

Mosquito the new Infostealer arrives to Mexico

there's blubank domain

#stealer

"Dissecting DCOM"

This article aims at giving an introduction to the base principles of COM and DCOM protocols as well as a detailed network analysis of DCOM

See also:
DCOM Lateral movement PoC
Lateral Movement Using DCOM and DLL Hijacking

awesome game security

#gh