WithSecureLabs/TickTock

Stars
102
Rank 335,584 (Top 7 %)
Language
C++
Created about 2 years ago
Updated about 2 years ago

WithSecureLabs/TickTock

WithSecureLabs

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

TickTock

This repository demonstrates a PoC memory scanner for enumerating timer-queue timers as used in Ekko Sleep Obfuscation: https://github.com/Cracked5pider/Ekko. For a full technical walkthrough please see the accompanying blog post here: https://labs.withsecure.com/publications/hunting-for-timer-queue-timers.html.

The screenshot below demonstrates the results of scanning for timer-queue timers while Ekko is running:

NB As a word of caution this PoC was tested on Windows 10 1607 and Windows 10 21h2. However, as it relies on undocumented functionality it may break due to future Windows releases.

Additionally, this tool requires symbols to be correctly configured and hence you will need to install the Debugging Tools for Windows (WinDbg) as a pre-requisite.

Related Work

https://github.com/joe-desimone/patriot

drozer

The Leading Security Assessment Framework for Android.

chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

C3

Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

needle

The iOS Security Testing Framework

doublepulsar-detection-script

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

awspx

A graph-based tool for visualizing effective access and resource relationships in AWS environments.

python-exe-unpacker

A helper script for unpacking and decompiling EXEs compiled from python code.

leonidas

Automated Attack Simulation in the Cloud, complete with detection use cases.

Jupyter Notebook

android-keystore-audit

physmem2profit

Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely

Jandroid

CallStackSpoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

bitlocker-spi-toolkit

Tools for decoding TPM SPI transaction and extracting the BitLocker key from them.

captcha22

CAPTCHA22 is a toolset for building, and training, CAPTCHA cracking models using neural networks.

doublepulsar-c2-traffic-decryptor

A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant

snake

snake - a malware storage zoo

Jamf-Attack-Toolkit

Suite of tools to facilitate attacks against the Jamf macOS management platform.

IAMSpy

damn-vulnerable-llm-agent

LinuxCatScale

Incident Response collection and processing scripts with automated reporting scripts

IceKube

peas

PEAS is a Python 2 library and command line application for running commands on an ActiveSync server e.g. Microsoft Exchange.

ppid-spoofing

Scripts for performing and detecting parent PID spoofing

detectree

Data visualization for blue teams

GarbageMan

GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.

drozer-agent

The Android Agent for the Mercury Security Assessment Framework.

doublepulsar-usermode-injector

A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or other security research.

ModuleStomping

https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/

dotnet-gargoyle

A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique

cloud-wiki

A public cloud security knowledgebase - https://www.secwiki.cloud/

AMSIDetection

AMSI detection PoC

tau-engine

A document tagging library

radare2-scripts

A collection of useful radare2 scripts!

CVE-2021-25374_Samsung-Account-Access

This script can be used to gain access to a victim's Samsung Account if they have a specific version of Samsung Members installed on their Samsung Device, and if the victim's device is from the US or Korea region.

ESFang

ESF modular ingestion tool for development and research.

macOSTriageCollectionScript

A triage data collection script for macOS

lazarus-sigma-rules

RemotePSpy

RemotePSpy provides live monitoring of remote PowerShell sessions, which is particularly useful for older (pre-5.0) versions of PowerShell which do not have comprehensive logging facilities built in.

FLAIR

F-Secure Lightweight Acqusition for Incident Response (FLAIR)

mongo-rs

A higher-level wrapper on top of the official bson & mongodb crates.

llm-vulnerable-recruitment-app

An example vulnerable app that integrates an LLM

volatility-plugins

FixerUpper

A Burp extension to enable modification of FIX messages when relayed from MitM_Relay

snake-core

snake-core - the real snake

jdiesel

jdiesel fuels the drozer

deject

Memory dump and Sample analysis tool

memory-carving-scripts

Scripts for extracting useful information from infected memory dumps

shadowhammer

Tools related to 'shadowhammer' attack, https://securelist.com/operation-shadowhammer/89992

keywe-tooling

Tools that can be used to interact with the KeyWe Smart Lock device.

datamate

usb-ninja-detection-poc

USB Ninja Detection PoC

iocs

snake-scales

snake-scales - the default repository of snake scales

dreamer

Easier cloud infrastructure with Terraform and Ansible

snake-skin

snake-skin - the web ui for snake

boops-boops-android-agent

snake-tail

snake-tail - the command line ui for snake

slide-decks