Introduction This blogpost will describe the concept of loading executables in-memory on macOS. This technique is mapped to MITRE ATT&CK under Reflective Code Loading (T1620). Over the many years I’ve used Cobalt Strike for red teaming, I’ve always appreciated the ability to load third-party software such as .NET assemblies and PowerShell…

Introduction This blogpost will describe how Transparency, Consent, and Control (TCC) affects extended attributes on macOS. TCC is a control that limits an application’s ability to interact with various services on the operating system. It controls access to services such as camera, microphone, contacts, photos, folders on disc, location services, and…

Introduction This blogpost will describe the concept of Location Services on macOS and how an attacker can utilize the Core Location APIs to track the geographical location of their targets. This technique is mapped to MITRE ATT&CK under System Location Discovery (T1614). Recently, I have been diving into understanding Transparency, Consent…

Introduction EDIT 7/16/23: Chromium added protections against this technique. Additional details can be found here: https://slyd0g.medium.com/debugging-cookie-dumping-failures-with-chromiums-remote-debugger-8a4c4d19429f This blogpost will describe the concept of cookie theft against Chromium browsers and how this technique can be utilized to access web applications without credentials. …

Introduction This blogpost will describe the concept of dynamic-link library (DLL) search order hijacking and how it can be used for userland persistence on Windows systems. This technique is mapped to MITRE ATT&CK under DLL Search Order Hijacking (T1038). DLL hijacking is useful to an attacker for a myriad of reasons…

Introduction This blogpost will describe the concept of access token manipulation and how this technique can be utilized against winlogon.exe to impersonate a SYSTEM access token from an administrator context. This technique is mapped to MITRE ATT&CK under Access Token Manipulation. Impersonating a SYSTEM access token is useful in cases that…

In this post, I will cover how to manipulate file times on the Windows OS. Manipulating timestamps is a common technique implemented in malware to blend in with other files on disc or as an anti-forensics technique. …

Clipboard Monitoring Have you ever wondered what occurs when you push Ctrl+C or right click some highlighted text/image and click copy on Windows? We’re going to look into detecting changes to the clipboard, clipboard events, and reading the data copied to the clipboard. Additionally, we’ll read the user’s current active window for…

LyncSniper LyncSniper is an essential tool for any external penetration test or red team engagement. It performs brute-force and password spraying attacks against Skype for Business to obtain valid credentials. LyncSniper was written by @domchell of the MDSec ActiveBreach Team. MDSec put out an awesome blogpost detailing exactly how LyncSniper works…