by frank | Mar 9, 2021 | Misc, Security
Reading Time: < 1 minuteQuick notes to remember Custom Tenable Custom plugins Adding custom NASL plugins to Tenable Nessus vi custom_feed_info.inccontent =PLUGIN_SET = “202109291526”;PLUGIN_FEED = “Custom”; vi toto.nasl script_id(900005);...
by frank | Mar 1, 2021 | AV, Red team, Security, Windows
Reading Time: < 1 minuteA very small little post, of a little experiment I did in my lab. I’ve used the nice and interesting code of Ausurusrex ( https://github.com/asaurusrex/Probatorum-EDR-Userland-Hook-Checker ) which is a C++ code that will show you all...
by frank | Feb 10, 2021 | AV, Blue Team, Security, Windows
Reading Time: < 1 minuteSysInternals, did promised it, and they delivered. Version 13 of Sysmon now comes with Id Event 25 which detects process hollowing and herpapining. This off course, would mainly be used by attackers when targeting systems which have a GPO...
by frank | Jan 8, 2021 | Blue Team, C2C, Security
Reading Time: < 1 minuteFollowing the really interesting article of Tek : https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/ Where he described how to get a valid URL for CobaltStrike, I tried to check if it was the same for...
by frank | Jan 5, 2021 | AV, Blue Team, Red team, Security, Windows
Reading Time: < 1 minuteDriver : SentinelMonitor Altitude 389040 Services: Name=LogProcessorService; DisplayName=SentinelOne Agent Log Processing Service; ServiceName=LogProcessorServiceName=SecurityHealthService; DisplayName=Windows Security Service;...
Recent Comments