mgeeky's lair

Chamber of Offensive Security

Category: Evasion

Backdooring Office Structures. Part 2: Payload Crumbs In Custom Parts

August 8, 2022 / / 3 Comments

Abstract

First part of this article outlined the basic techniques for hiding malware payloads within Office document structures, as well as mildly touched on dilemmas for embedding them into VBA and pulling from the Internet.

This blog post discusses yet another technique, which as far as I’m concerned – represents a novel, stealthy primitive for storing larger chunks of data that could be easily extracted using specific VBA logic. We introduce an idea of weaponising Custom XML parts storage, available in MS Word, Excel and PowerPoint for the purpose of concealing initial access payloads.

Continue reading

ProtectMyTooling – Don’t detect tools, detect techniques

July 22, 2022 / / 0 Comments

Introduction

Threat Actors and malware developers need to protect their intellectual property just as much as benign software vendors. Every Cybersecurity professional who worked with malware samples will also know, that such a protection employed helps adversaries morph/mutate how their malicious artifacts look & feel under the hood, eventually evading signatured detection.

Executable protectors, obfuscators, encoders, packers/compressors, virtualizers – are all specialized software attempting to manipulate input artifacts, producing output with often altered code layout and contents. Sometimes for file size reduction purposes, other time to fend off reverse engineers aiming to disclose their technology & implementation details.

Continue reading

WarCon 2022 – Modern Initial Access and Evasion Tactics

June 25, 2022 / / 8 Comments

Hi there!

Looks like its my first blog post, yay! What is it that I should write about to begin that journey? Have no clue really, but also it just happens I had a great pleasure of presenting at todays (25/06/2022) @WarConPL conference.

The conference full of Exploit Development geeks, Vulnerablity Research wizards and other sort of hardcore experts…. and me with that kinda out of place Red Teaming stuff slide deck 🤩

These were my initial thoughts at least, before I started talking. Having finished my presentation turned out many folks in there did their share in Adversary Simulation – and to my surprise – approached me to express how they’ve enjoyed my talk, came to start up cool discussions, shared ideas for awesome new TTPs.

Also, I’ve been asked at numerous occassions whether my slides are going to be shared anywhere. Since I promised, therefore I deliver:

WarCon22 – Modern Initial Access and Evasion Tactics.pdf

Let me know in comments and on Twitter what you think!

Continue reading

About Mariusz

Mariusz is an active security researcher, pentester and red team operator currently involved in advanced adversary simulations.

He is best known for his researches on malware development and frequent releases of offensive tools that help red teams bolster their game against cybersecurity criminals.

© 2024 mgeeky's lair

Theme by Anders Noren — Up ↑