BlackArrow (Tarlogic)

In a few hours, our colleague Kurosh_ Dabbagh_ Escalante_ will talk at EuskalHack about call stack spoofing to hide the execution of implants from memory. #ESCVII ➡️ Read more: https://lnkd.in/dEaShPQZ

Are you aware of this technique for achieving fileless persistence? Find out how it works and how to detect it. ➡️ https://lnkd.in/dBV4ZxMD

Our colleagues Kurosh_ Dabbagh_ Escalante_ & Inés Martín Mínguez will be at #HackOn2024 presenting an alternative approach to ROP-based sleep obfuscation technique to evade memory scanners.    [➡️]  Read more: https://lnkd.in/d2WaWFjG

Our colleague Iago Abad Barreiro has weaponized the leaked token handles technique for MSSQL. Now open token handles in MSSQL's process (sqlservr.exe) can be abused to change security context and escalate privileges both locally and in the domain. https://lnkd.in/dMbgaZVH

Are you aware that Threat Actors can use virtualization as an effective evasion technique? Our #ThreatHunting team presents some useful queries to detect this technique. ➡ https://lnkd.in/dgg3yJBQ

The new BlackArrow (Tarlogic) threadless code injection technique for Windows systems was already presented by Kurosh_ Dabbagh_ Escalante_ at Navaja Negra. Stay tuned if you can't follow it; we'll keep you posted. #RedTeam #EDR #evasion #NN11ED #processinjection

In a few minutes, our colleague Kurosh_ Dabbagh_ Escalante_ will present at Navaja Negra a new method of threadless code injection for Windows processes through the hijacking of DLL entry points. #NN11ED   ➡️ Watch it live (Spanish) at: https://lnkd.in/dPCpbPiQ #RedTeam #EDR #evasion #NN11ED #processinjection

The Navaja Negra conference is just around the corner! Kurosh_ Dabbagh_ Escalante_ will be on-site to talk about malware development and EDR evasion. ➡ Read more: https://lnkd.in/dCk6bVs2 #RedTeam #EDR #evasion #NN11ED #processinjection

Watchguard has fixed 4 vulnerabilities in Watchguard EPDR discovered by our researchers Antón Ortigueira and Marcos Díaz Castiñeiras.   These vulnerabilities can be used to disable the defensive capabilities of the product and achieve privilege escalation.   ➡ Advisories: https://lnkd.in/dZTSXk8g

That’s the BlackArrow army 🐺🐺🐺   #getreadtohack #redteam #threathunting #readytohunt