攻防技战术动态一周更新 - 20260615

原创

红蓝对抗技术
红蓝对抗技术

红蓝对抗技战术

2026年6月22日 22:40
北京

在小说阅读器读本章

去阅读

漏洞相关

1、

红队技术

1、Sleeping Beauty II: CFG, CET, and Stack Spoofing

https://maorsabag.github.io/posts/adaptix-stealthpalace/sleeping-beauty-ii/

2、Offensive Security: Speeding up Active Directory Pentests with ADScan and ADPulse

https://hackers-arise.com/offensive-security-speeding-up-active-directory-pentests-with-adscan-and-adpulse/

3、Windows Privilege Escalation 01: Initial Enumeration

https://niklas-heringer.com/penetration-testing/windows-privilege-escalation-01/

4、Harnessing the Power of Cobalt Strike Profiles for EDR Evasion – Part 3

https://whiteknightlabs.com/2026/06/15/harnessing-the-power-of-cobalt-strike-profiles-for-edr-evasion-part-3/

5、What Are Windows Logon Sessions and How Do They Relate to Tokens?

https://trainsec.net/library/windows-internals/windows-logon-sessions-and-tokens/

6、Unveiling DNSStager: A tool to hide your payload in DNS

https://askar.so/blogs/unveiling-dnsstager-a-tool-to-hide-your-payload-in-dns/

7、WinGet

https://ipurple.team/2026/06/09/winget/

8、EDR 的“自毁”开关

https://mp.weixin.qq.com/s/sfV9u7VQGvfrCejvkmZdjA

9、Hunting ROP Gadgets in Windows DLLs

https://medium.com/@s12deff/hunting-rop-gadgets-in-windows-dlls-3184e4eeba62

蓝队技术

1、Interlock and Rhysida within the ransomware ecosystem

https://www.ibm.com/think/x-force/interlock-and-rhysida-within-the-ransonware-ecosystem

工具类

1、WhatAboutSAM

https://github.com/PeterGabaldon/WhatAboutSAM

WhatAboutSAM is my custom PoC of a Windows SAM dumper

2、UNCanny Coerce

https://github.com/0xHossam/UnCanny

Another new coercion primitive with LPE 0day - machine-account NTLM coercion from a non-admin user via Windows Store InstallService plugin resolution experiments

3、Proxer

https://github.com/Skuntir/Proxer

A modern HTTP and HTTPS interception proxy with custom-made extensions support.

4、ETWPrism: User-Mode ETW Interception Lab

https://github.com/kernullist/ETWPrism

5、LACUNA Chain

https://github.com/MazX0p/LACUNA-Chain

https://0xmaz.me/posts/LACUNA-Chain-Ghost-Frames-defeats-All-EDR-layers-of-call-stack-based-detection/

Six-layer call-stack spoofing via .pdata lacunae — defeats ETW-Ti, kernel callbacks, CET shadow stack, and return-address validation in a single composite chain.

7、Windows Sandbox .wsb HostFolder NTLM Leak

https://github.com/0xHossam/UNCagedSandbox

8、Rust for Malware Development

https://git.smukx.site/smukx/Rust-for-Malware-Development

9、PhantomCtx

https://github.com/r3xmax/PhantomCtx

https://mp.weixin.qq.com/s/ZhAgr31ND0GaSbZIeGPcXQ

Activation Context Hijacking Evasion Tool

10、ShellHWEventExec

https://github.com/0xHossam/ShellHWEventExec

BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEventHandler flow + ssh-shellhost.exe direct PTY command execution behavior.

11、Atomic BOFs

https://rastamouse.me/atomic-bofs/

12、RawHive

https://github.com/nmht3t/RawHive

Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data straight from disk.

其他类

1、