A Loader With No Command Line

a day ago by digicat to c/blueteamsec

A fake benefit-statement ZIP whose loader is a renamed, validly signed Python interpreter steered by a path-configuration file, so the malicious code path never appears on any command line. It ended in a ScreenConnect install that least privilege, not detection, stopped.

blueteamsec

@infosec.pub

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

go to feed...

blueteamsec

@infosec.pub

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

go to feed...