@dtmsecurity

Cobalt Strike DNS Direct Egress Not That Far Away

Cobalt Strike 4.3 added a bunch of useful new DNS beacon features which allow the behaviour to be tweaked more than before. Prior to this release the configuration was

Code execution via the Windows Update client (wuauclt)

Its been a few months since my last post about uploading and downloading data with certreq.exe as a potential alternative to certutil.exe in LOLBIN land. I've been having

Upload and download small files with CertReq.exe

I stumbled on another lesser known LOLBAS (https://lolbas-project.github.io/) for upload and downloading (small) files. CertReq.exe is present on Windows and its intended use to to assist

Exploring search connectors and library files in Windows

IntroductionThis short post explores the file formats .searchConnector-ms and .library-ms. Both of these file formats have default file associations on most Windows versions. They integrate with Windows to show content

Sorry you have missed a package

In Windows 10 there’s a handy way for administrators to provision systems by way of something known as a “Provisioning Package”. This blog explores these files which carry a

The origin of command and control traffic

When chatting through the DNS over HTTPS based command and control technique with defenders, something which came up in a blue teams arsenal caught my attention. This was JA3 which is an open source project from Salesforce which has been integrated into a lots

Playing with DNS over HTTPS (DoH)

It has been nearly a month since I spoke at Mitre ATT&CKcon and shared some research into DNS over HTTPS (DoH) from a red team perspective. After releasing the tool DoHC2 there has been quite a few people using it and talking

DNS over HTTPS (DoH) Servers

I recently conducted some research into DNS over HTTPS (DoH) that is documented here. When it came to identifying any publically available DoH servers available on the Internet I found the best resource to be the curl wiki page to be the best place