44 results for “Enumeration”

Wiz Research reviews agentic attacks seen in its incident response work and in public reports (ARTEX, Hermes, JPCERT/CC, CrowdStrike, DIVD). It derives fingerprints of AI-agent activity from three intrusions: machine-paced iteration, natural-language reasoning in scripts, self-correcting script versions, checklist enumeration, noisy lateral spraying, probe-before-payload and self-labeled scratch files. It also covers effects on attribution, attack scale and defense.

wiz.ioarticlePublished and added 29 Oct 2026🛡️ Security

Wiz research on intrusions where AI agents do the hands-on attacker work. It reviews public cases (ARTEX against South Korean banks and the ConnectWise compromise, Hermes at Thailand's Ministry of Finance, JPCERT/CC, CrowdStrike, DIVD) and three Wiz-investigated attacks. It distills fingerprints: machine-paced iteration, embedded natural-language reasoning, self-correcting scripts, checklist enumeration, noisy lateral movement, probe-before-payload habits and self-named scratch files. It also covers attribution, scale and defense implications.

wiz.iowriteupPublished and added 29 Oct 2026🛡️ Security

Non-profiled single-trace side-channel attack on ML-DSA-65 (Dilithium) running on ARM Cortex-M4, by Linus Backlund and Elena Dubrova (KTH). It compares observed sample distributions with expected Hamming weight leakage using a Gaussian mixture model, and stacks partitioned trace segments for multiple observations. Information-set decoding corrects misclassifications; with a 2^70 enumeration budget, the full secret key is recovered from one trace in 99% of attacks, using secret key unpacking as the attack point.

eprint.iacr.orgpaperPublished and added 26 Oct 2026🛡️ Security

Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.

dfir.chwriteupAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Presents Creed, an LLM-based code auditing approach that infers a developer's security-related beliefs for a function, scores how reasonable each is, and derives the conditions under which it is violated. It catches domain-specific semantic flaws that syntactic static analysis misses, such as a timing side-channel that undermines user-enumeration protection. The paper also introduces two measures for explanation-based vulnerability detection, recall and overhead. On a recent real-world benchmark, Creed beats existing explanation-based tools on the effectiveness-effort trade-off.

arxiv.orgpaperAdded 15 Oct 2026, published 11 Oct 2026🛡️ Security

Infoooze is an open-source command-line OSINT reconnaissance toolkit (github.com/devxprite/infoooze) that consolidates common footprinting tasks into one CLI: username enumeration across platforms, email discovery, subdomain enumeration, port scanning, WHOIS/DNS lookups, IP/HTTP header analysis, EXIF metadata extraction, GitHub recon, and URL scanning/expansion. It automatically saves results, making it a lightweight all-in-one alternative to running several separate recon tools.

x.comrepoPublished and added 8 Oct 2026🛡️ Security

malcontent is Chainguard's open-source malware/supply-chain discovery tool that analyzes binaries (ELF, Mach-O, PE, a.out) and scripting-language source across Linux, macOS and Windows using 14,500+ YARA rules (including third-party rules from Avast, Elastic, FireEye, Mandiant, Nextron and ReversingLabs). Its standout feature is differential analysis ("mal diff"), which compares two versions of a build artifact or OCI image against a known-good baseline to surface newly introduced risky behaviors — the technique the project demonstrates on the 3CX supply-chain compromise by flagging unexpected high-risk changes to libffmpeg. It also supports threshold-based scanning ("mal scan") and unfiltered capability enumeration ("mal analyze"), and is designed to run inside CI/CD pipelines, including air-gapped environments via embedded rules.

github.comrepoAdded 8 Oct 2026🛡️ Security

Huntress details a four-act intrusion against a shared parks-and-recreation management platform running on IIS, where an attacker first tried noisy unauthenticated exploits (IIS 8.3 tilde enumeration, WebDAV verb abuse, upload-handler bypasses) before simply registering a member account and uploading .aspx webshells via a member-file upload feature across three servers. The attacker enumerated hosts, extracted web.config/connection strings, hunted for cardholder data (Fortis/MXMerchant webhook logs, CVV/card-number strings), then escalated to timestomping, re-deploying known-filename webshells, and finally injecting an AI-generated PowerShell/JS dropper into a trojanized jQuery file to turn site visitors' browsers into WebRTC/WebSocket C2 clients (ririmochii/bubuneeko Cloudflare Workers infrastructure). Includes a zh-CN PowerShell user-agent string used for attribution and full command/IOC listings useful for detection engineering.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

A Hackers Arise tutorial demonstrates pentesting office VoIP phone systems using SIPVicious against an Asterisk PBX lab set up in Docker. It walks through svmap for service/version fingerprinting, svwar for extension enumeration, and svcrack for password attacks (wordlist, default numeric range, and --enabledefaults), then ties the compromise to real risks like toll fraud and vishing via stolen SIP credentials.

hackers-arise.comwriteupAdded 7 Oct 2026, published 28 Sep 2026🛡️ Security

Lonkero is an open-source Rust web vulnerability scanner (v3.7) combining 125+ context-aware scanners with an AI agent mode that drives targeted scans via natural-language conversation (using Claude, GPT, or local Ollama models). Notable techniques include a browser-free "proof-based" XSS engine that mathematically proves exploitability from reflection context + escape behavior, an "OOBZero" engine for detecting blind SQLi/SSRF/XXE via Bayesian multi-channel statistical inference and Pearson-correlated timing attacks without external callback infrastructure, Next.js middleware-bypass detection (CVE-2025-29927, CVE-2024-34351), AWS Cognito user-enumeration checks, and a scanner module that detects invisible prompt-injection payloads hidden in README.md files targeting AI coding assistants.

github.comrepoAdded 21 Sep 2026🛡️ Security

Outrider Recon is an open-source, Claude-native multi-agent OSINT and external attack-surface recon platform for authorized engagements, covering web/API, identity/SSO, cloud, secrets, and people/breach intelligence. It deliberately stops short of exploitation: active enumeration is approval-gated and intrusive validation is a human hand-off, with deterministic Python controls enforcing scope, evidence integrity, workflow state, and finding promotion around Claude skills and optional MCP-based enrichment. Output is ranked, evidence-backed finding cards (confidence/severity/handoff recommendations) meant to feed proxy-assisted testing or pen-testing rather than raw scanner dumps.

github.comrepoAdded 22 Sep 2026, published 19 Sep 2026🛡️ Security

Datadog Security Labs walks through hunting for GitHub organization compromise using GitHub audit logs, covering the full attack chain from stolen PATs/OAuth tokens and device-code phishing (initial access) through secrets-listing enumeration, private-repo/tree discovery, and bulk collection via git.clone or repo.download_zip. It provides copy-pasteable queries (with fields like hashed_token, programmatic_access_type, external_identity_nameid) mapped to MITRE ATT&CK techniques and calls out GitHub audit-log quirks (missing IP on failed auth, inconsistent visibility fields, misleading token permission scopes) that shape accurate detections.

securitylabs.datadoghq.comwriteupAdded 25 Sep 2026, published 16 Sep 2026🛡️ Security

A Huntress blog post breaking down how attackers abuse Windows Volume Shadow Copy Service (VSS) beyond the well-known "delete shadow copies before ransomware detonation" pattern — including creating shadow copies to quietly extract NTDS.dit for credential access, and manipulating shadow copy size/configuration. It details why single VSS events (creation/deletion) are noisy, useless alerts on their own, and describes how Huntress correlates VSSAdmin activity with lateral movement, credential-harvesting commands, and process lineage over a time window, illustrated with a real incident involving PsExec, vssadmin create shadow against a domain controller, a blocked cleanup attempt, and follow-on DNS enumeration.

huntress.comarticleAdded 22 Sep 2026, published 15 Sep 2026🛡️ Security

BugScanner is an asyncio/httpx Python framework for recon and automated web vulnerability scanning, with a React and FastAPI dashboard. It covers subdomain enumeration (crt.sh, DNS brute force), TCP port scanning, fingerprinting, and modules for XSS, SQLi, CORS, SSRF, open redirect, JWT, IDOR and business logic, plus a Nuclei wrapper. A 5-rule false-positive filter with SPA detection, adaptive rate limiting, WAF detection and SARIF export are included.

github.comrepoAdded 20 Oct 2026, published 5 Sep 2026🛡️ Security

StepSecurity's Harden-Runner GitHub Action v2.21.0 adds a denied-endpoints input, letting teams block specific egress destinations (domains, wildcards, bare IPs) from CI jobs while leaving everything else reachable — a lighter-weight alternative to allow lists that don't require full enumeration of a job's needs. The piece details how deny-list entries differ from allow-list ones (no per-port scoping), covers the flagship use case of forcing package installs through StepSecurity's Secure Registry proxy by denying direct access to registries like PyPI and Go module hosts, and explains that Harden-Runner's separately maintained Global Block List (built from SOC threat intel, e.g. the Megalodon credential-exfiltration campaign) is distinct from and complements user-managed deny lists. It also candidly notes the deny list's blind spot: campaigns like Shai-Hulud 2.0 that exfiltrate via github.com itself can't be stopped by a deny list, requiring allow-list enforcement instead.

stepsecurity.ioarticleAdded 3 Sep 2026, published 2 Sep 2026🛡️ Security

StepSecurity describes a new Credentials inventory page in Dev Machine Guard that scans developer machines for thirteen well-known credential source types (npm, PyPI, Docker, AWS, GCP, Kubernetes, Vault, GitHub, SSH keys, etc.) across five categories and reports how many devices hold each, how many entries exist, and whether the material is stored in plaintext or protected. It frames the feature against real attacker behavior - the TeamPCP stealer in the xinference PyPI package and the hijacked Bitwarden CLI npm package both enumerated this exact list of well-known dotfile paths - arguing defenders need the same enumeration attackers already have to scope incidents and plan rotations.

stepsecurity.ioarticleAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

subScraper is a self-contained, single-file (main.py) Python orchestrator that chains subdomain enumeration tools (Amass, Subfinder, Assetfinder, Findomain, Sublist3r) into httpx probing, screenshot capture, ffuf fuzzing, nuclei, and nikto scans, all driven from a live web UI with resumable job state, worker concurrency controls, and Docker packaging. It ships 34 custom nuclei templates for CVEs lacking official coverage and exposes a scoped, API-key-authenticated "bug bounty agent API" for programmatic recon and attack-surface queries against a target's scope.

github.comrepoPublished and added 27 Aug 2026🛡️ Security

Rekono is an open-source pentesting automation platform that chains 19 hacking tools (Nmap, Nuclei, Metasploit, OWASP ZAP, Nikto, Gitleaks, SearchSploit, etc.) so that output from one tool feeds the next, automatically covering recon, service enumeration, vulnerability scanning, and exploit correlation. It deduplicates findings into a single attack-surface inventory per host/port, enriches CVEs with community context for prioritization, tracks fixed/reopened vulnerabilities, and supports team collaboration, scheduled scans, Telegram/email alerts, and report generation for engagements.

github.comrepoAdded 3 Sep 2026, published 27 Aug 2026🛡️ Security

A practical guide to web fuzzing for bug bounty hunters, covering wordlist selection (custom vs. SecLists-style generic lists), and tool-specific configuration for content discovery, subdomain/VHost enumeration, and parameter/header discovery using ffuf, Burp Suite Intruder, OWASP Amass, dnsx, Arjun, and Param Miner. It details concrete techniques such as subdomain permutation patterns, extension fuzzing for leftover files (.md, .env, .sql), dotfile/prefix patterns (/.FUZZ, /-FUZZ, /~FUZZ), IIS-specific extensions (.asmx, .ashx, .aspx.bak), and hidden-header fuzzing (X-Forwarded-For, X-Debug, X-HTTP-Method-Override) that can lead to SQLi, cache poisoning, or access-control bypass.

intigriti.comarticleAdded 3 Sep 2026, published 21 Aug 2026🛡️ Security

Huntress details an Akira ransomware intrusion from August 2026 that followed the group's usual SonicWall SSL VPN → domain controller → AD enumeration → WinRAR/s5cmd exfiltration → detonation playbook, but with a new twist: the affiliate ran msconfig.exe to force a reboot into Safe Mode with Networking (MITRE T1688), which killed the Huntress agent and Windows Defender real-time protection while preserving network access, after pre-registering an AnyDesk service to survive the minimal Safe Mode driver set. The blog notes Safe Mode's constrained virtual memory appears to have caused akira.exe to crash with out-of-memory errors, accidentally sabotaging the attacker's own encryption run, and closes with detection guidance for boot-configuration changes, Safe Mode Kernel-Boot/Kernel-General event IDs, and Safe Boot registry tampering.

huntress.comwriteupAdded 3 Sep 2026, published 12 Aug 2026🛡️ Security

FinalRecon is a Python-based OSINT/reconnaissance tool for web targets, gathering header info, whois data, SSL certificate details, crawling, DNS enumeration, subdomain discovery, port scanning, and directory search in a single utility. It's commonly used during the recon phase of web application pentests to consolidate multiple footprinting techniques into one CLI tool.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

A Hackers-Arise walkthrough for building a custom Telegram OSINT toolkit in Python using Telethon's MTProto API instead of the limited Bot API, enabling full message-history access, group member enumeration (up to 200/request), and message/engagement metadata collection. The toolkit also extracts EXIF/GPS metadata from downloaded media (via Pillow/piexif) to geolocate targets, persists results in SQLite via aiosqlite, and exposes everything through a Click CLI with modules for profile, members, messages, and media lookups.

hackers-arise.comarticleAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

ShadowDorks is a free browser-based tool that generates over 1000 advanced Google dork queries for a target domain, covering categories like exposed admin panels, subdomain enumeration, and API key/credential leaks. It's built for pentest recon and OSINT reconnaissance workflows, letting a user paste a domain and copy ready-to-search dork strings.

shadohdorks.vercel.apptoolAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Walkthrough of two Active Directory pentesting utilities: ADScan, a Docker/BloodHound-integrated tool for automated DNS/LDAP/SMB/Kerberos enumeration and attack (Kerberoasting, AS-REP roasting, DCSync, password spraying, ADCS escalation path discovery, DACL/GenericAll abuse via SDProp misconfig), and ADPulse, a read-only LDAP/LDAPS auditing tool that produces CLI/JSON/HTML security posture reports for AD environments. The piece demonstrates installation on Kali and a worked example where a low-privileged account is shown to have GenericAll rights over Domain Admins, plus checks for known DC vulnerabilities like Zerologon and NoPac.

hackers-arise.comwriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

OpenOSINT is a Python OSINT agent that wraps 20 investigation tools (holehe for email enumeration, sherlock for username lookup, sublist3r for subdomain enumeration, phoneinfoga for phone intel, plus HaveIBeenPwned, Shodan, VirusTotal, Censys, AbuseIPDB, IP2Location, DNS/SPF/DMARC checks, GitHub, and Bright Data-powered dorking/scraping) behind a natural-language AI interface that issues deterministic tool calls so findings can't be hallucinated. It ships as a REPL, CLI, MCP server (usable from Claude Code/Desktop, Cursor, Windsurf), or browser web UI, with an optional additive FollowTheMoney entity graph for correlating findings and pivoting between investigation results, plus documented reverse-proxy/credential-handling behavior for remote deployments.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Claude-OSINT is a library of 8 drop-in Claude Skills (SKILL.md files, ~10,000 lines) that turn Claude/Claude Code into a structured external-recon operator for authorized red-team and bug-bounty engagements. The core pair (osint-methodology, offensive-osint) covers a 6-stage recon pipeline, an 80-pattern secret scanner, 80+ dorks, and read-only credential validators, while six organization-grade skills add legal-entity-to-footprint mapping, SPF/email-spoofability analysis, FAIR-based dollar risk scoring, continuous exposure re-scan/diff monitoring, cloud/SaaS and dependency-confusion checks, and identity-provider tenant/user-enumeration with explicit hard scope boundaries (no password spraying, no active exploitation).

github.comrepoPublished and added 31 Jul 2026🛡️ Security

dfs-large1 is depthfirst's vulnerability discovery and validation model, post-trained from GLM 5.2 with multi-task RL inside its security agent harness, in partnership with Fireworks AI. The report covers the reward design (effort penalty, finding budget), masked importance-sampling optimization, task-level advantage normalization, summarization-based context compaction and the sandboxed evaluation setup. It reports that the learned audit strategy moved from broad enumeration to hypothesis testing with executable harnesses. Benchmark numbers and the dfbench methodology are not given.

depthfirst.comarticleAdded 29 Oct 2026, published 30 Jul 2026🛡️ Security

PentesterFlow is an open-source terminal AI agent for authorized offensive-security engagements, connecting to local or hosted LLMs (Ollama, LM Studio, Anthropic, Gemini, DeepSeek, Groq, OpenRouter, etc.) to plan and execute recon, enumeration, vulnerability validation, and evidence-backed reporting against a scoped target. It gates sensitive actions behind analyst approval, bridges with Burp Suite for traffic capture/finding import via a local listener and companion MCP server, and maintains persistent project/personal memory (redacting secrets) to carry lessons and coverage state across sessions. The demo walks through discovering and confirming an IDOR on an orders API and writing findings to a local markdown report.

github.comrepoPublished and added 29 Jul 2026🛡️ Security

Wiz Research scanned MCP servers across cloud environments and found roughly 1 in 6 environments expose at least one server to the Internet, most unauthenticated and still running the pre-auth 2024-11-05 protocol version. They demonstrate anonymous tool-catalog enumeration, real data returned from production databases/CRM/IAM backends, write/delete-capable tools, and confirmed SSRF against cloud instance metadata endpoints yielding temporary credentials, plus agents that can be talked into unsafe actions by reframing requests as "routine maintenance."

wiz.iowriteupAdded 3 Sep 2026, published 28 Jul 2026🛡️ Security

Bug Bounty Lab101 is a workspace that structures the real HackerOne bug bounty workflow: document program scope, run scope-gated recon/vuln scanning via bugbounty-hunter.sh (backed by a 400+ tool arsenal spanning recon, DNS enumeration, web scanning, exploitation, and cloud/subdomain-takeover checks), then produce a triage-ready H1 report with Hacktivity dedup checks. It also integrates T3MP3ST, a separate multi-agent offensive framework that connects local AI coding agents (Claude Code, Codex) to automate target investigation, and ships a legacy-vm-practice lab (DVWA/Metasploitable-style) for safe skill-building outside real program scope.

github.comrepoPublished and added 25 Jul 2026🛡️ Security

A GitHub repository (also published as a GitBook) of study notes compiled while pursuing the Hack The Box CPTS certification, structured to double as OSCP prep material. It covers networking fundamentals, enumeration, privilege escalation, Active Directory attacks, and pivoting with hands-on methodologies and tool usage rather than just theory.

github.comrepoAdded 3 Sep 2026, published 18 Jul 2026🛡️ Security

A GitHub repository compiling personal study notes and cheatsheets for HackTheBox's CPTS (Certified Penetration Testing Specialist) certification, organized by module: network enumeration (Nmap), web footprinting, file transfers, shells/payloads, Metasploit, password attacks, pivoting/tunnelling, Active Directory enumeration and attacks, web app attacks (SQLi, SQLMap, XSS, LFI, file upload, command injection, Ffuf), and Linux/Windows privilege escalation. It functions as a reference guide mirroring the official HTB Academy course structure rather than original research.

github.comrepoPublished and added 18 Jul 2026🛡️ Security

ADhammer is an open-source Rust CLI for authorized Active Directory assessments that discovers domain state, maps attack paths to Tier-0, and reports findings with an explicit evidence/validation status. Its v1.5.2 release adds an ESC1-based KB5014754 PKINIT bypass against Full-Enforcement KDCs, pass-the-hash DCSync, workstation preflight checks, and a hardened error classifier. It exposes a 74-method catalog spanning enumeration, Kerberos/credential attacks, delegation/S4U abuse, coercion/relay, and remote execution, plus reusable Rust protocol crates and an SDK.

github.comrepoAdded 2 Oct 2026, published 17 Jul 2026🛡️ Security

Huntress recovered and reconstructed "Untitled1.ps1," a PowerShell Active Directory enumeration script used by an attacker during a June 3 incident via RDP access with compromised credentials, and identified it as AI-generated ("vibe-coded") based on artifacts like an unedited LLM placeholder hostname, a "FULLY FIXED" prompt-iteration title, over-engineered five-method DC-discovery fallback logic, and gratuitous colored console/HTML reporting output. The attack chain paired this bespoke recon tool with off-the-shelf abuse of s5cmd (legitimate AWS S3 CLI used for exfiltration) and SharpShares (share enumeration), illustrating how LLM-generated one-off malware evades hash/signature-based detection and pushes defenders toward behavioral analytics on Active Directory enumeration patterns.

huntress.comwriteupAdded 3 Sep 2026, published 8 Jul 2026🛡️ Security

Snyk's VulnBench JS 1.0 report runs 300 repeated agentic security-review scans (10 JS/Express fixtures x 6 model configs x 5 repetitions) to measure whether LLMs like Claude Opus 4.6/4.7 and Claude Sonnet 4.6 find the same vulnerabilities twice, benchmarked against deterministic Snyk Code SAST reference findings. Key results: reference-matched LLM findings were highly repeatable (84.8% appeared in all 5 runs) while extra, non-reference LLM findings were unreliable (only 14% reproduced in all runs), the best LLM config (Opus 4.6 Medium) reached only 75.4% Snyk-reference F1 with a 24.6-point gap to SAST, and higher-cost models (Opus 4.7 Max) did not outperform cheaper ones despite 5.7x cost. The study argues LLM review and SAST catch different vulnerability classes (LLMs strong on injection/SSRF-type bugs, weak on path traversal/resource-limit enumeration) and should be combined rather than substituted.

snyk.iowriteupAdded 3 Sep 2026, published 29 Jun 2026🛡️ Security

Part 6 of Huntress's "From Code to Coverage" series reverse-engineers ldapnomnom's LDAP Ping (cLDAP-style) Active Directory username enumeration technique, tracing its Go source down to the Windows Filtering Platform to test the tool's claim of generating "no Windows audit logs." Lab testing shows Event 1644 never fires for LDAP Ping (it's processed by netlogon.dll, not the ntdsa.dll LDAP engine it monitors), but netlogon.log captures every queried username including disabled-account detail attackers can't see, while Event 5156 attributes source IP for ldapnomnom's TCP connections — a gap that disappears entirely if an attacker switches to true UDP cLDAP (as demonstrated with a custom cldap_ping.py), leaving only MDI's threshold-based external ID 2437 as network-layer coverage. The piece also audits the ldeep tool's enum_users transport and provides a PowerShell correlation script joining netlogon.log and Event 5156 within a 5-second window.

huntress.comwriteupAdded 3 Sep 2026, published 24 Jun 2026🛡️ Security

Ethical-Hacking-Labs is a free, practical tutorial/lab collection aligned with CEH study material, walking learners from foundational networking, Linux, and virtualization through footprinting, scanning, enumeration, vulnerability analysis, system hacking, malware, sniffing, social engineering, DoS, and session hijacking, plus a bonus forensics module. It targets complete beginners and requires only a lab VM setup (8GB+ RAM, 80GB disk, virtualization support) to follow along hands-on rather than just reading theory.

github.comrepoPublished and added 8 May 2026🛡️ Security

ProcMon-MCP is an MCP server that gives AI assistants like Claude direct access to Windows internals: live process enumeration, ETW kernel trace start/stop via logman/tracerpt, static PE import/export analysis with API category tagging, Security event log queries (audit IDs 4688/4624/4672/4648), and service/driver/minifilter enumeration. It's positioned as a POC for security researchers and reverse engineers who want an LLM that can query kernel traces, driver lists, and process memory instead of alt-tabbing to Task Manager or Process Monitor. Several tools (ETW tracing, Security log reads) require administrator privileges and can trigger UAC prompts.

github.comrepoPublished and added 7 May 2026🛡️ Security

Part 5A of Huntress's LDAP/AD detection series explains why native PowerShell commands like Get-ADComputer -Properties * evade traditional LDAP-based detections: PowerShell's ActiveDirectory module uses Active Directory Web Services (ADWS) over encrypted SOAP on port 9389 rather than LDAP on 389/636, and the resulting Event 1644 log shows the query originating from localhost ([::1]) instead of the attacker's real IP. The author shows how to correlate Event 1644 with ADWS connection/session events (1138, 1139, 1166, 1167) via shared Operation ID to reconstruct full enumeration sessions, and flags the "[all_with_list]" attribute prefix and "SDflags:0x7" server control as high-fidelity indicators of PowerShell bulk property/security-descriptor dumps (as used by tools like BloodHound). It also demonstrates that case obfuscation of cmdlets (e.g., geT-aDcompUTER) is irrelevant at the LDAP layer since PowerShell is case-insensitive and translates to standard LDAP filters before reaching the DC.

huntress.comwriteupAdded 3 Sep 2026, published 8 Apr 2026🛡️ Security

Huntress breaks down the surge in Remote Monitoring and Management (RMM) tool abuse, citing a 277% jump in 2025 and finding that over 50% of suspicious Atera RMM activity cases tie back to ransomware. It walks through a real SOC incident where a threat actor used stolen RMM credentials to gain initial access to an MSP partner's environment, ran enumeration commands, and attempted to disable the Huntress agent before being contained within 12 minutes, and recommends shifting from trusting approved-tool presence to behavioral baselining and executable/endpoint fingerprinting of RMM software.

huntress.comarticleAdded 3 Sep 2026, published 5 Mar 2026🛡️ Security

Part three of Huntress's LDAP/Active Directory detection series explains the SDFlags LDAP control (bitmask values 0x1/0x2/0x4/0x8 for Owner/Group/DACL/SACL) that SharpHound must use when querying the nTSecurityDescriptor attribute to avoid failing silently due to SACL read permissions. The author shows via lab testing and Event ID 1644 log analysis that legitimate admin tools almost never use SDFlags, while SharpHound consistently sets SDFlags=0x4 for general object enumeration and 0x5 (Owner+DACL) for group and certificate template enumeration, making the combination of mass enumeration + nTSecurityDescriptor + SDFlags a high-fidelity signal for BloodHound-style attack-path discovery. It concludes with a Sigma detection rule (ECS field names) targeting SDFlags=0x5 group enumeration and references SharpHoundCommon's LdapConnectionPool.cs source code confirming the behavior.

huntress.comarticleAdded 3 Sep 2026, published 15 Jan 2026🛡️ Security

Huntress details six months of research into malicious Azure/Entra ID OAuth applications, splitting them into "Traitorware" (legitimate-looking apps commonly abused by attackers, ~10% of surveyed tenants had at least one) and "Stealthware" (custom-built OAuth Illicit Consent Grant apps used for persistence and data theft). Drawing on enumeration of 8,000+ tenants and Huntress partner telemetry, the SOC found over 500 confirmed Stealthware instances and identifies detection heuristics (low global app prevalence + single-user delegation + powerful permission scopes). The post also announces Cazadora, an open-source script that authenticates via Graph API to hunt rogue Enterprise Applications and App Registrations for known malicious naming patterns and reply URLs.

huntress.comwriteupAdded 3 Sep 2026, published 10 Feb 2025🛡️ Security

A reverse-engineering walkthrough of qwinsta.exe showing it uses the undocumented WinStation API (winsta.dll) — WinStationOpenServerW, WinStationEnumerateW, WinStationQueryInformationW — rather than the documented Terminal Services (WTS) API used in harmj0y's prior PowerShell approach. The author demonstrates that remote session enumeration via these APIs succeeds against a target host even when Remote Desktop is disabled, and provides C++ code to load winsta.dll, resolve the undocumented function pointers via GetProcAddress, and parse the resulting byte-array structures to extract usernames and session state.

0xv1n.github.iowriteupAdded 3 Sep 2026, published 14 Jul 2024🛡️ Security

Release notes for PowerZure 2.1, a PowerShell Azure exploitation toolkit, detailing new offensive functions including Invoke-AzureVMUserDataAgent/Command which abuse the VM userData property for log-free command execution, and Invoke-AzureMIBackdoor which exposes the IMDS REST API externally via portproxying to steal Managed Identity JWTs without authentication. Also adds Get-AzureManagedIdentities and Get-AzurePIMAssignment for enumeration, plus several bug fixes to existing cmdlets.

hausec.comarticleAdded 3 Sep 2026, published 21 Dec 2021🛡️ Security