Loading video...

Video Failed to Load

Go Home

WMI Lateral Movement Demonstration: SMB file transfer with Win32_Process execution #ThreatHunting #DFIR

ACEResponder's profile picture

ACE Responder

17,824 subscribers

28,992 views • 3 years ago •via X (Twitter)

#ThreatHunting#DFIR
LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Remote execution with scheduled tasks demonstration. #DFIR #ThreatHunting
0:40

Remote execution with scheduled tasks demonstration. #DFIR #ThreatHunting

ACE Responder

25,033 views • 2 years ago

How PsExec lateral movement works. #ThreatHunting #DFIR
0:37

How PsExec lateral movement works. #ThreatHunting #DFIR

ACE Responder

27,763 views • 2 years ago

Detecting Remote Service Lateral Movement (formerly PsExec) #ThreatHunting #DFIR
5:23

Detecting Remote Service Lateral Movement (formerly PsExec) #ThreatHunting #DFIR

ACE Responder

21,063 views • 1 year ago

An example of DCOM lateral movement - MMC20.Application with a mshta payload #ThreatHunting #DFIR
0:46

An example of DCOM lateral movement - MMC20.Application with a mshta payload #ThreatHunting #DFIR

ACE Responder

24,980 views • 3 years ago

🗝️A skeleton key attack patches LSASS on the victim's domain controller. This enables the attacker to authenticate as any user with a master password. #ThreatHunting #DFIR
0:53

🗝️A skeleton key attack patches LSASS on the victim's domain controller. This enables the attacker to authenticate as any user with a master password. #ThreatHunting #DFIR

ACE Responder

22,043 views • 2 years ago

Today's cold-blooded execution of a citizen of Minneapolis is Trump's response to yesterday’s powerful demonstration against ICE’s reign of terror. It is urgent that workers build a rank-and-file movement for a nationwide general strike!
4:27

Today's cold-blooded execution of a citizen of Minneapolis is Trump's response to yesterday’s powerful demonstration against ICE’s reign of terror. It is urgent that workers build a rank-and-file movement for a nationwide general strike!

David North

18,706 views • 6 months ago

How AS-REP Roasting works. 🔐 This animation demonstrates the more secure Kerberos pre-auth and contrasts it with an AS-REP roasting attack which abuses the 'Do not require Kerberos preauthentication' setting. #ThreatHunting #DFIR
1:07

How AS-REP Roasting works. 🔐 This animation demonstrates the more secure Kerberos pre-auth and contrasts it with an AS-REP roasting attack which abuses the 'Do not require Kerberos preauthentication' setting. #ThreatHunting #DFIR

ACE Responder

33,121 views • 2 years ago

When your hips and shoulders rotate simultaneously at takeaway, it creates excessive lateral movement and poor weight transfer. #golf
0:22

When your hips and shoulders rotate simultaneously at takeaway, it creates excessive lateral movement and poor weight transfer. #golf

Kerrod Gray | Professional Golf Coach

210,458 views • 1 year ago

Making movement easier with Frido Patient Transfer Lift. Designed and Made in 🇮🇳
0:25

Making movement easier with Frido Patient Transfer Lift. Designed and Made in 🇮🇳

Ganesh Sonawane

1,128,685 views • 4 months ago

Cowork is now available on Windows. We’re bringing full feature parity with MacOS: file access, multi-step task execution, plugins, and MCP connectors.
0:30

Cowork is now available on Windows. We’re bringing full feature parity with MacOS: file access, multi-step task execution, plugins, and MCP connectors.

Claude

2,792,675 views • 6 months ago

"I am hitting him with lateral movement" is some of the craziest trash talk ever 😂 Hakeem Olajuwon was always calculated with his 'sophisticated s**t talk'.
1:09

"I am hitting him with lateral movement" is some of the craziest trash talk ever 😂 Hakeem Olajuwon was always calculated with his 'sophisticated s**t talk'.

KG: Certified

204,264 views • 8 months ago

Getting better in handling relighting, motion transfer and lip movement transfer. Test done with a custom wan workflow + various loras I guess you can now act from anywhere
0:33

Getting better in handling relighting, motion transfer and lip movement transfer. Test done with a custom wan workflow + various loras I guess you can now act from anywhere

Stelfie the Time Traveller

40,148 views • 9 months ago

Lateral skipping with changes of rhythm isn’t just for youth development — it’s also used at the professional level. Great for coordination, footwork and movement efficiency.
0:33

Lateral skipping with changes of rhythm isn’t just for youth development — it’s also used at the professional level. Great for coordination, footwork and movement efficiency.

⚽️Pedro Mendonça🧠

21,329 views • 18 days ago

🚨 THREAT INTELLIGENCE ALERT 🚨 The tool 🇨🇳 KernelGhost820 is being actively sold on the underground market for US$ 2,500, complete with full source code. This is a professional-grade suite with an intuitive graphical interface and six advanced modules, specifically designed for EDR evasion and sophisticated ransomware operations with efficient lateral movement: • EDR Removal Engine: Automatically detects and terminates more than 40 security products (including CrowdStrike, SentinelOne, Microsoft Defender, Kaspersky, and others). Supports Kernel, UserMode, and NTDLL termination modes, kernel driver loading for protected processes, disabling Windows Defender, and blocking telemetry connections. • Ransomware Module: Dual encryption using AES256CBC + RSA2048, supporting over 70 file types (documents, images, databases, backups, etc.). Automatically deletes Volume Shadow Copies to prevent recovery, generates custom ransom notes with Bitcoin addresses and contact emails, and changes the desktop wallpaper. • Remote Operations & Mass Deployment: Connects to remote devices on the local network via WMI (requires username and password). Scans installed software on target hosts, performs process termination, and enables one-click full tool deployment. Includes full-network scanning for open SMB port 445 with real-time progress tracking. • Detailed Process Manager and full Operation Logger (exportable to TXT). This tool significantly lowers the technical barrier for advanced ransomware actors targeting corporate environments. Immediate monitoring recommendations: • Evaluate the resilience of your EDR/XDR controls against kernel-mode bypass techniques • Intensify monitoring of anomalous SMB (port 445) traffic and WMI connections • Strengthen network segmentation and the principle of least privilege Our team is actively tracking this tool and any emerging variants. #ThreatIntelligence #Ransomware #EDRBypass #CyberSecurity #InfoSec #CyberThreat
3:20

🚨 THREAT INTELLIGENCE ALERT 🚨 The tool 🇨🇳 KernelGhost820 is being actively sold on the underground market for US$ 2,500, complete with full source code. This is a professional-grade suite with an intuitive graphical interface and six advanced modules, specifically designed for EDR evasion and sophisticated ransomware operations with efficient lateral movement: • EDR Removal Engine: Automatically detects and terminates more than 40 security products (including CrowdStrike, SentinelOne, Microsoft Defender, Kaspersky, and others). Supports Kernel, UserMode, and NTDLL termination modes, kernel driver loading for protected processes, disabling Windows Defender, and blocking telemetry connections. • Ransomware Module: Dual encryption using AES256CBC + RSA2048, supporting over 70 file types (documents, images, databases, backups, etc.). Automatically deletes Volume Shadow Copies to prevent recovery, generates custom ransom notes with Bitcoin addresses and contact emails, and changes the desktop wallpaper. • Remote Operations & Mass Deployment: Connects to remote devices on the local network via WMI (requires username and password). Scans installed software on target hosts, performs process termination, and enables one-click full tool deployment. Includes full-network scanning for open SMB port 445 with real-time progress tracking. • Detailed Process Manager and full Operation Logger (exportable to TXT). This tool significantly lowers the technical barrier for advanced ransomware actors targeting corporate environments. Immediate monitoring recommendations: • Evaluate the resilience of your EDR/XDR controls against kernel-mode bypass techniques • Intensify monitoring of anomalous SMB (port 445) traffic and WMI connections • Strengthen network segmentation and the principle of least privilege Our team is actively tracking this tool and any emerging variants. #ThreatIntelligence #Ransomware #EDRBypass #CyberSecurity #InfoSec #CyberThreat

Clandestine

40,619 views • 3 months ago

A file transfer setup using no internet, Bluetooth, or USB drive. The sender converts the file into encoded QR code frames displayed rapidly on screen. The receiver scans those frames continuously with its camera and reconstructs the original file. The camera is the only communication bridge. Works entirely offline particularly relevant for air-gapped systems where network transfer isn't an option.
0:20

A file transfer setup using no internet, Bluetooth, or USB drive. The sender converts the file into encoded QR code frames displayed rapidly on screen. The receiver scans those frames continuously with its camera and reconstructs the original file. The camera is the only communication bridge. Works entirely offline particularly relevant for air-gapped systems where network transfer isn't an option.

Md Ismail Šojal 🕷️

64,446 views • 1 month ago

Neat look from Belal He switches to open stance to cut off JDM's lateral movement with his body kick then steps through to orthodox to close distance and immediately threaten with pressure
0:21

Neat look from Belal He switches to open stance to cut off JDM's lateral movement with his body kick then steps through to orthodox to close distance and immediately threaten with pressure

MixingMartialArts

117,850 views • 1 year ago

Here’s some drip marketing for the exploit I’m dropping. Full RCE over network play with arbitrary file transfer while you play. Stay tuned, it gets better…
0:27

Here’s some drip marketing for the exploit I’m dropping. Full RCE over network play with arbitrary file transfer while you play. Stay tuned, it gets better…

Ryan M

70,722 views • 2 years ago

Shakur Stevenson says he’s not a “runner” and people are making narratives based on one performance with Edwin De Los Santos. He explains why he used lateral movement in that fight.
1:33

Shakur Stevenson says he’s not a “runner” and people are making narratives based on one performance with Edwin De Los Santos. He explains why he used lateral movement in that fight.

Naji

26,682 views • 6 months ago

Another cool app built with Perplexity Computer. A peer to peer file(s) transfer web app. Sends files directly with no accounts using WebRTC and DTLS encryption, file chunking, socket io signaling. I am impressed by how many libraries and tools Computer can orchestrate reliably.
0:54

Another cool app built with Perplexity Computer. A peer to peer file(s) transfer web app. Sends files directly with no accounts using WebRTC and DTLS encryption, file chunking, socket io signaling. I am impressed by how many libraries and tools Computer can orchestrate reliably.

Aravind Srinivas

52,596 views • 5 months ago