Getting Executables into Memory (Going Fileless)

Поделиться
HTML-код
  • Опубликовано: 5 ноя 2024

Комментарии • 19

  • @deathxe5
    @deathxe5 2 года назад +1

    Amazing, thank you

  • @DavidEmily
    @DavidEmily Год назад +2

    I'm loving these videos. Remember me when you're famous!

    • @CyberAttackDefense
      @CyberAttackDefense  Год назад +2

      No fame seeking here. Just hoping to give back to the community

  • @bugbounty5870
    @bugbounty5870 Год назад

    Amazing video. Very much helpful

  • @Kingdd1os
    @Kingdd1os Год назад

    Amazing ❤ Do you give full courses any where Sir?

    • @CyberAttackDefense
      @CyberAttackDefense  Год назад

      I am going to be teaching for SANS in the offensive security curriculum coming soon!

  • @novianindy887
    @novianindy887 10 месяцев назад +1

    Can we do it on exe that are generated with PyInstaller?
    what would be the get method main?
    And what if the PC in a corporate environment doesnt have access to powershell (set through GPO policy)? then it wont work?

    • @CyberAttackDefense
      @CyberAttackDefense  9 месяцев назад

      I have never attempted that. There is no such thing as no access to PowerShell. Check out powerpick.

  • @CyberCelt.
    @CyberCelt. Год назад

    Excellent video, subscribed

  • @rongabay6598
    @rongabay6598 Год назад

    hey thanks a lot about the amzing vdieo.
    i try to that with mimikatz but i an error can do a video that you show how to that with mimikat or answer me how to solve it thanks

    • @CyberAttackDefense
      @CyberAttackDefense  9 месяцев назад

      Mimi Katz won’t work with this method. Try invoke mimikatz

  • @Ichinin
    @Ichinin Год назад

    Nothing on disk... except a powershell script.

    • @CyberAttackDefense
      @CyberAttackDefense  Год назад

      Only if script block logging is turned on. Ottherwise that’s not on disk either.

    • @Ichinin
      @Ichinin Год назад

      @@CyberAttackDefense Only if you rely on standard Windows logging capabilities...

    • @CyberAttackDefense
      @CyberAttackDefense  Год назад

      I would love to hear how you can do this without Windows logging or EDR. Can you explain?

    • @Ichinin
      @Ichinin Год назад

      @@CyberAttackDefense Didn't say you could do it without EDR or anything else.
      My opinion is that Windows logging by default sucks and has to be configured before use and you can just use something else instead. Even if it is configured it is not as detailed as 3rd party products or even Sysmon.

    • @CyberAttackDefense
      @CyberAttackDefense  Год назад

      Agreed. Windows logging without tuning or sysmon is not good enough for threat detection. Sysmon adds value but doesn't mean you can't do effective detection without it. There are many attacks that just won't make logs though for example responder style attacks