Patryk Czeczko (@0xpat) 's Twitter Profile
Patryk Czeczko

@0xpat

Red/purple teamer
linkedin.com/in/patryk-czec…

ID: 1232769920175427585

linkhttp://0xpat.github.io calendar_today26-02-2020 20:51:32

18 Tweet

1,1K Followers

27 Following

marcoverip.bsky.social 🌻 (@marcoverip) 's Twitter Profile Photo

In case you missed it: Im writing a multi part blog on RedELK, Outflank’s open sourced tooling that acts as a red team SIEM and helps with overall improved oversight during red team operations: outflank.nl/blog/2019/02/1… outflank.nl/blog/2020/02/2… outflank.nl/blog/2020/04/0…

Grzegorz Tworek (@0gtweet) 's Twitter Profile Photo

Wanted to demonstrate AdjustTokenPrivileges() -> SomePrivilegedCall() sequence, and failed with SetSystemTime(). And now I know: SetSystemTime() tries to adjusts privileges on it's own, not even checking the result, and then calls NtSetSystemTime() syscall. Interesting...

Wanted to demonstrate AdjustTokenPrivileges() -> SomePrivilegedCall() sequence, and failed with SetSystemTime(). And now I know: SetSystemTime() tries to adjusts privileges on it's own, not even checking the result, and then calls NtSetSystemTime() syscall. Interesting...
Vlado Vajdic (@vvlado) 's Twitter Profile Photo

Detecting APT29: MITRE EDR evaluations round 2 - Jorrit Folmer - Medium -> not everyone is a winner! medium.com/@jorritfolmer/…

Grzegorz Tworek (@0gtweet) 's Twitter Profile Photo

Eliminate huge part of lateral movement scenarios with one command: "reg.exe add HKLM\SYSTEM\CurrentControlSet\Control /v DisableRemoteScmEndpoints /t REG_DWORD /d 1" It will make Service Control Manager deaf to remote management. Everything else works properly.

Eliminate huge part of lateral movement scenarios with one command: "reg.exe add HKLM\SYSTEM\CurrentControlSet\Control /v DisableRemoteScmEndpoints /t REG_DWORD /d 1"
It will make Service Control Manager deaf to remote management. Everything else works properly.
Patryk Czeczko (@0xpat) 's Twitter Profile Photo

0xpat.github.io/Malware_develo… Check out compilation tips, PE overwiew, hiding imports, API hashing and calculating entropy

/ˈziːf-kɒn/ (@x33fcon) 's Twitter Profile Photo

Would you like to learn more about Applied #PurpleTeaming? Come and join us, Patryk Czeczko and lǝʍɐd tomorrow at 1500 UTC. Learn more: x33fcon.com/#!w/purple.md Free registration: x33fcon.com/#!webinarregis…

Would you like to learn more about Applied #PurpleTeaming? Come and join us, <a href="/0xPat/">Patryk Czeczko</a> and <a href="/c0p0x/">lǝʍɐd</a> tomorrow at 1500 UTC.

Learn more: x33fcon.com/#!w/purple.md

Free registration: x33fcon.com/#!webinarregis…
Patryk Czeczko (@0xpat) 's Twitter Profile Photo

x33fcon.com/#!s/malware.md This year during /ˈziːf-kɒn/ we will code some covert shellcode loader in C++ lǝʍɐd #redteam #purpleteam #malware #workshop