The Curious Engineer

All blogs / Security

splintercod3.blogspot.com

splintercod3.blogspot.com

14 Sep 2023    -  Bypassing UAC with SSPI Datagram Contexts 10 Feb 2023    -  LocalPotato - When Swapping The Context Lea...

SecurityWindows internals

’16’17’18’19’20’21’22’23’24’25’26
Posts
16 from 26 Jun 2016 to 10 Feb 2023
Posting
quiet since 2023
Kind
personal blog

2023 1

  1. LocalPotato - When Swapping The Context Leads You To SYSTEM

2022 5

  1. Custom-Branded Ransomware: The Vice Society Group and the Threat of Outsourced Development
  2. Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor
  3. Giving JuicyPotato a second chance: JuicyPotatoNG
  4. The hidden side of Seclogon part 3: Racing for LSASS dumps
  5. A very simple and alternative PID finder

2021 3

  1. The hidden side of Seclogon part 2: Abusing leaked handles to dump LSASS memory
  2. Hide and Seek | New Zloader Infection Chain Comes With Improved Stealth and Evasion Mechanisms
  3. Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol

2020 2

  1. Weaponizing Mapping Injection with Instrumentation Callback for stealthier process injection
  2. No more JuicyPotato? Old story, welcome RoguePotato!

2019 1

  1. We thought they were potatoes but they were beans (from Service Account to SYSTEM again)

2017 2

  1. Reverse Engineering a Javascript Obfuscated Dropper
  2. Bypassing UAC with SSPI Datagram Contexts

2016 2

  1. New Locky variant - Zepto Ransomware Appears On The Scene
  2. Locky Ransomware is back! 49 domains compromised!