Hacktool

The GoldenDMSA tool facilitates unauthorized manipulation and authentication bypass against Active Directory Group Managed Service Accounts (gMSA).

Defendnot is a hacktool that impairs Windows Defender by abusing the Windows Security Center API to register itself as a fraudulent antivirus product.

The Defendnot hacktool is deployed via PowerShell one-liners to disable Windows Defender by registering a malicious, fake antivirus product through undocumented WSC APIs.

The Defendnot hacktool utilizes a custom scheduled task for persistence and abuses the Windows Security Center API to register itself as a fake antivirus product to disable Windows Defender.

Detection of the Dumpert hacktool, used to dump memory from the lsass.exe process to facilitate credential theft.

Adversaries utilize the SharpView C# port of PowerView to perform extensive Active Directory reconnaissance, domain enumeration, and discovery of sensitive network objects.

Adversaries utilize BloodHound and SharpHound to perform automated reconnaissance and enumeration of Active Directory environments, facilitating lateral movement and privilege escalation.

This brief covers detection strategies for the Rubeus hacktool, which is frequently used by attackers to perform Kerberos-based credential theft and lateral movement.

The PowerUp tool is leveraged by attackers to perform DLL hijacking for privilege escalation by writing malicious batch files to the filesystem.

XORDump is a utility used by attackers to dump process memory, specifically targeting lsass.exe to facilitate credential theft.

Adversaries use the SelectMyParent utility to perform Parent Process ID (PPID) spoofing, enabling stealthy process execution by masquerading as legitimate system processes.

This brief details the SysmonEnte hacktool, an open-source utility developed by codewhitesec, designed to attack the integrity of Microsoft Sysmon processes to impair endpoint detection and bypass security monitoring on Windows systems.

This brief describes the detection of highly relevant antivirus alerts specifically flagging hacktools or other attack tools via distinct signatures, indicating the presence of offensive security utilities or malicious software on endpoints, which requires immediate investigation despite the AV's block action.

This brief covers the detection of NetExec, a post-exploitation and lateral movement tool, through monitoring for unique file creation patterns associated with its execution and file extraction in Windows environments.