Hagrid29

PE loader with various shellcode injection techniques

Hagrid29

Dumping LSASS with a duplicated handle from custom LSA plugin

Hagrid29

C# implementation of Get-AADIntSyncCredentials from AADInternals, which extracts Azure AD Connect credentials to AD and Azure AD from AAD connect database.

Hagrid29

Patch AMSI and ETW in remote process via direct syscall

Hagrid29

Active Directory certificate abuse

Hagrid29

Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping

Hagrid29

Abuse Azure API permissions for red teaming

Hagrid29

Cobalt Strike Beacon Object File (BOF) that uses CredUIPromptForWindowsCredentials API to invoke credential prompt

Hagrid29

Cobalt Strike Beacon Object File (BOF) that obtain SYSTEM privilege with SeImpersonate privilege by passing a malicious IUnknwon object to DCOM call of PrintNotify.

Hagrid29

Cobalt Strike Beacon Object File (BOF) that uses LogonUserSSPI API to perform kerberos-based password spray

Hagrid29