David McGuire

Code Signing Certificate Cloning Attacks and Defenses

Ready to hunt? First, Show me your data!

Nowadays, Threat Hunting is a very popular topic among not just security practitioners in…

Designing Effective Covert Red Team Attack Infrastructure

The PowerView PowerUsage Series #4

This is a short follow-up to my “A Guide to Attacking Domain Trusts” post, and the fourth post in my “PowerView PowerUsage” series. It follows the same Scenario/Solution/Explanation pattern as the previous entries, with the original post containing a constantly updated…

Adventures in Extremely Strict Device Guard Policy Configuration Part 1 — Device Drivers

Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript

A Look at CVE-2017–8715: Bypassing CVE-2017–0218 using PowerShell Module Manifests

Bypassing Application Whitelisting with runscripthelper.exe

Introduction

While running through one of the labs for our PowerShell course, I stumbled upon a Microsoft-signed PowerShell host process in System32 — runscripthelper.exe. This program was just…

Raphael’s Thoughts: SpecterOps acquires MINIS

Today, SpecterOps announces its acquisition of MINIS LLC. The company is doing its social media thing to spread the word. I wanted to take a moment to share the news and comment on it in my own words. If you want press release language, we have that…

SharpHound: Technical Details

In the previous blog post, we focused on SharpHound from an operational perspective, discussing some of the new features, as well as improved features from the original ingestor. In this post, we’ll talk more about the technical and underlying changes made to the ingestor that…