Kostas's banner

Kostas

@Kostastsale • 19,822 subscribers

I like building things that solve real problems, working across cybersecurity, product, and research | 🇬🇷🇨🇦

Shorts

Sometimes the call comes a little too late and you gotta do what you gotta do 😂

Sometimes the call comes a little too late and you gotta do what you gotta do 😂

11,535 просмотров

$I came across a great persistence mechanism and created a Sigma rule for it. Just drop your batch script or add a line that points to your payload inside C:\Windows\Setup\Scripts\ErrorHandler.cmd, and upon execution of C:\Windows\System32\oobe\Setup.exe, the payload will run. In the clip below, I have cmd.exe /c calc.exe as the payload. If ErrorHandler doesn't exist, you can create it along with the directory. Thanks to @Hexacorn for posting about it 🙏 In regards to the rest binaries under the C:\Windows\System32\oobe\ directory, most of them will not work, whereas others will force a restart (i.e. audit.exe) 🔗:$

I came across a great persistence mechanism and created a Sigma rule for it. Just drop your batch script or add a line that points to your payload inside C:\Windows\Setup\Scripts\ErrorHandler.cmd, and upon execution of C:\Windows\System32\oobe\Setup.exe, the payload will run. In the clip below, I have cmd.exe /c calc.exe as the payload. If ErrorHandler doesn't exist, you can create it along with the directory. Thanks to @Hexacorn for posting about it 🙏 In regards to the rest binaries under the C:\Windows\System32\oobe\ directory, most of them will not work, whereas others will force a restart (i.e. audit.exe) 🔗:

17,501 просмотров

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

I created the first draft of a website for the EDR telemetry project to help people quickly compare vendor telemetry visibility. What do you think about it? Are there any specific features you want to see for the website? Built with ChatGPT 4o with canvas (wanted to test it out😂) EDR Telemetry project 🔗:

I created the first draft of a website for the EDR telemetry project to help people quickly compare vendor telemetry visibility. What do you think about it? Are there any specific features you want to see for the website? Built with ChatGPT 4o with canvas (wanted to test it out😂) EDR Telemetry project 🔗:

140,482 просмотров • 1 год назад

Enjoy your weekend yall 😅

Enjoy your weekend yall 😅

34,595 просмотров • 6 месяцев назад

It’s time! We’re slowly opening the gates to the Threat Hunting Labs for everyone who registered. Watch your inbox.

It’s time! We’re slowly opening the gates to the Threat Hunting Labs for everyone who registered. Watch your inbox.

18,866 просмотров • 4 месяцев назад

A Day in the Life of a CISO

A Day in the Life of a CISO

65,448 просмотров • 2 лет назад

Больше нет контента для загрузки