Bypassing Signature-Based AV

If you want to execute arbitrary code on an endpoint during a penetration test, chances are you’ll have to evade some kind of antivirus solution. AV engines use two detection methods to identify malicious code – signature-based and heuristic-based...

User Enumeration Part 3 – Windows

This is the third installment in a series of blogs on user enumeration.  In Part 1 – Building Name Lists, I talked about ways of building usernames from OSINT and US census data. In this installment, I’m going to discuss putting this info to work in...

Deceiving the Red Team with GPP

A common tactic used by pen testers, “red teams”, and threat actors is searching for Group Policy Preference (GPP) files with usernames and passwords.  These XML files, stored in the domain SYSVOL, are used to create local administrator accounts, map...