TOOL: DarkWidow | Soumyanil Biswas скачать в хорошем качестве

TOOL: DarkWidow | Soumyanil Biswas

🔗 Join us in-person and virtually at our Wild West Hackin' Fest: information security conferences — https://wildwesthackinfest.com/ 🔗 Register for Infosec Webcasts, Anti-casts & Summits. – https://poweredbybhis.com Links to the demos used in this presentation: DarkWidow V1 : Evade ( NonAdmin process) Sophos XDR : "Call For Tools" Demo    • DarkWidow V1 : Evade ( NonAdmin  process) ...   DarkWidow V1: Evade (Admin privilege process) Sophos XDR: "Call For Tools" Demo    • DarkWidow V1: Evade (Admin privilege proce...   DarkWidow V2 - Synthetic Frame Thread Stack Spoofing Enabled    • DarkWidow V2 - Synthetic Frame Thread Stac...   This is a Dropper/Post-Exploitation Tool targeting Windows machines. Its capabilities include: 1. Indirect Dynamic Syscall 2. SSN + Syscall address sorting via Modified TartarusGate approach 3. Remote Process Injection via APC Early Bird (MITRE ATT&CK TTP: T1055.004) 4. Spawning a sacrificial Process as the target process 5. ACG(Arbitrary Code Guard)/BlockDll mitigation policy on spawned process 6. PPID spoofing (MITRE ATT&CK TTP: T1134.004) 7. Api resolving from TIB (Directly via offset (from TIB) - TEB - PEB - resolve Nt Api) (MITRE ATT&CK TTP: T1106) 8. Cursed Nt API hashing 9. With Admin privileges: Disables Event Log via killing all threads of svchost.exe, i.e. killing the whole process (responsible svchost.exe) Finally, I will showcase my tool demo video which would perform a successful Execution of payload and provide crystal clear Event Log against Sophos XDR enabled Environment. Version 2 has Synthetic Frame Thread Stack Spoofing version enabled. It will be released at BlackHat Asia 2024 on April 18th, 2024, ///Black Hills Infosec Socials Twitter:   / bhinfosecurity   Mastodon: https://infosec.exchange/@blackhillsi... LinkedIn:   / antisyphon-training   Discord:   / discord   ///Black Hills Infosec Shirts & Hoodies https://spearphish-general-store.mysh... ///Black Hills Infosec Services Active SOC: https://www.blackhillsinfosec.com/ser... Penetration Testing: https://www.blackhillsinfosec.com/ser... Incident Response: https://www.blackhillsinfosec.com/ser... ///Backdoors & Breaches - Incident Response Card Game Backdoors & Breaches: https://www.backdoorsandbreaches.com/ Play B&B Online: https://play.backdoorsandbreaches.com/ ///Antisyphon Training Pay What You Can: https://www.antisyphontraining.com/pa... Live Training: https://www.antisyphontraining.com/co... On Demand Training: https://www.antisyphontraining.com/on... Antisyphon Discord:   / discord   Antisyphon Mastodon: https://infosec.exchange/@Antisy_Trai... ///Educational Infosec Content Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/ Wild West Hackin' Fest YouTube:    / wildwesthackinfest   Antisyphon Training YouTube:    / antisyphontraining   Active Countermeasures YouTube:    / activecountermeasures   Threat Hunter Community Discord:   / discord   Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com/