In Part 2, we engineered a delivery method for the AmsiScanBuffer Bypass discussed in Part 1. In this post, we’ll make some modifications to the bypass itself.

In Part 1, we had a brief look at the AmsiScanBuffer bypass technique. We found some circumstances where the bypass code would be identified as malicious before it could be executed (which turned out to be a simple string detection), and modified the code to circumvent this.

In this post, we’ll explore a delivery method to help stage a Cobalt Strike / Empire / <insert framework here> agent. As with Part 1, this is not about some 1337 code drop - it’s a demonstration of how I walked through engineering the final result.

So, let’s get cracking.

Andre Marques recently posted a pretty nice write-up for circumventing AMSI, based on previous work by CyberArk.

With the emergence of more C# and .NET tooling, I occasionally see people tripping up over this. It’s not a huge issue, just something to be aware of.

Very quick post to explore some different ways to enumerate the AppLocker configuration being applied to a host, both remotely and locally. Understanding these rules, particularly deny rules, are useful for engineering bypasses.

This is just a quick post to demonstrate some interesting aspects of the Remote Desktop Clipboard Monitor.

In April 2018, Casey Smith published a finding he dubbed squiblytwo, which detailed how WMIC can be used to invoke arbitary code contained in the extensible stylesheet language (XSL) format.

Along with Cn33liz, I recently had the pleasure of assisting Nikhil Mittal with his 2018 BruCON spring training: Active Directory Attacks for Red and Blue Teams.

Persistence, noun, the continued or prolonged existence of something.

In Part 1 we explored how one could go about discovering and mapping the LAPS configuration in a domain. In this part, we’ll look at various ways LAPS can be abused for persistence purposes.