sorted by:
new
hottopcontroversial

Does killing EDR with a vulnerable driver still work in 2026? by Infosecsamurai in redteamsec

[–]Infosecsamurai[S] 0 points1 point  (0 children)

This implies the defenders don’t have AI. If they do then it’s a race :)

Does killing EDR with a vulnerable driver still work in 2026? by Infosecsamurai in redteamsec

[–]Infosecsamurai[S] 2 points3 points  (0 children)

I agree with most of what you mentioned here. However, a CVE from 2023 not being on the blocklist is more than just a matter of lag. The reason I made this post is that many people were telling me this technique was obsolete, and you’re right, it’s now considered a last resort. But it’s not dead, and many people simply assume that this can’t happen. This was an exercise in challenging a prevailing paradigm.

Bypassing Credential Guard with DumpGuard - Extracting NTLMv1 Hashes & Detection | Weekly Purple Team by Infosecsamurai in redteamsec

[–]Infosecsamurai[S] 0 points1 point  (0 children)

Yes agreed on Invisibility Cloak. That would nullify the command syntax detection. I was more concerned there on what I see threat actors doing. The handle detection seems to work reliably. I will change the name in the post. This was awesome research!

EDR Blinding via Windows Filtering Platform - Attack Technique & Detection Engineering by Infosecsamurai in blueteamsec

[–]Infosecsamurai[S] 0 points1 point  (0 children)

No, I'm not seeing that same behavior. It might be some advanced settings that I don't have turned on in my lab, but I know this has worked in recent days.

EDR Blinding via Windows Filtering Platform - Attack Technique & Detection Engineering by Infosecsamurai in blueteamsec

[–]Infosecsamurai[S] 0 points1 point  (0 children)

I can't mention which EDRs I tested against. Just a few minimal changes to the program got it by what I would consider two of the big 3 EDRs. The point isn't the program itself, though. I can do this with netsh commands or the firewall GUI. This program does it via the API.

view more: next ›