Explore >> Select a destination

You are here

 pentestarmoury.com
Creeping on Users with WMI Events: Introducing PowerLurk | Pentest Armoury
| | pentestlab.blog
Persistence RID Hijacking Penetration Testing Lab
11.1 parsecs away

Travel
| | Windows operating systems use the RID (Relative Identifier) to differentiate groups and user accounts. It is part of the Security Identifier (SID) and every time a new account or a group is created the number is increased by one. The local administrator group RID is always 500 and standard users or groups typically start with
| | bc-security.org
PowerShell Logging: Obfuscation and Some New(ish) Bypasses Part 1 - BC Security
14.0 parsecs away

Travel
| |
| | adsecurity.org
» PowerShell Version 5 Security Enhancements » Active Directory Security
12.4 parsecs away

Travel
| |
| | blog.talosintelligence.com
Suspected CoralRaider continues to expand victimology using three information stealers
52.3 parsecs away

Travel
| Talos also discovered a new PowerShell command-line argument embedded in the LNK file to bypass anti-virus products and download the final payload into the victims' host.