Explore >> Select a destination

You are here

 bohops.com
No Alloc, No Problem: Leveraging Program Entry Points for Process Injection - bohops
| | gist.github.com
env_var_spoofing_NGenAssemblyUsageLog_poc.cpp · GitHub
3.1 parsecs away

Travel
| | env_var_spoofing_NGenAssemblyUsageLog_poc.cpp. GitHub Gist: instantly share code, notes, and snippets.
| | pentestlaboratories.com
AppDomainManager Injection and Detection | Pentest Laboratories
2.4 parsecs away

Travel
| | Microsoft .NET framework is being heavily utilized by threat actors and red teams for defense evasion and staying off the radar during operations. Every .NET binary contains application domains where assemblies are loaded in a safe manner. The AppDomainManager object can be used to create new ApplicationDomains inside a .NET process. From the perspective of...
| | cocomelonc.github.io
Malware AV/VM evasion - part 15: WinAPI GetModuleHandle implementation. Simple C++ example. - cocomelonc
3.2 parsecs away

Travel
| | [AI summary] A technical blog post demonstrates how to create a custom implementation of the WinAPI GetModuleHandle function to evade antivirus detection in malware, including code examples for PEB manipulation and string encryption.
| | scriptjunkie.us
Authenticated Remote Code Execution Methods in Windows « Thoughts on Security
29.1 parsecs away

Travel
| [AI summary] The post details eight specific Windows features and services, such as SCM and Task Scheduler, that can be exploited to perform authenticated remote code execution on networked systems.