/explore

Click through on any links that interest you or select the planets on the right to continue exploring the Outer Web.
You are here

 www.forrest-orr.net
Masking Malicious Memory Artifacts - Part II: Blending in with False Positives
| | thewover.github.io
Emulating Covert Operations - Dynamic Invocation (Avoiding PInvoke & API Hooks) - The Wover - Red Teaming, .NET, and random computing topics
4.3 parsecs away

Travel
| | TLDR: Presenting DInvoke, a new API in SharpSploit that acts as a dynamic replacement for PInvoke. Using it, we show how to dynamically invoke unmanaged code from memory or disk while avoiding API Hooking and suspicious imports.
| | blog.dingusxmcgee.com
Fake Software Abusing Real Software For Fun And Profit - Part 2!? | Malware Analysis with Dingus
4.8 parsecs away

Travel
| | Picking up where we left off, from Part 1.
| | pentestlaboratories.com
AppDomainManager Injection and Detection | Pentest Laboratories
4.9 parsecs away

Travel
| | Microsoft .NET framework is being heavily utilized by threat actors and red teams for defense evasion and staying off the radar during operations. Every .NET binary contains application domains where assemblies are loaded in a safe manner. The AppDomainManager object can be used to create new ApplicationDomains inside a .NET process. From the perspective of...
| | www.trendmicro.com
Ransomware Spotlight: Clop | Trend Micro (US)
25.1 parsecs away

Travel
| We take a closer look at the operations of Clop, a prolific ransomware family that has gained notoriety for its high-profile attacks. We review this ransomware group's constantly changing schemes and discuss how companies can shore up defenses against this threat.