攻防技战术动态一周更新 - 20261012

原创

红蓝对抗技术
红蓝对抗技术

红蓝对抗技战术

2026年10月17日 18:50
北京

去阅读

漏洞相关

1、WPAD LPAC / WHESVC privilege escalation

https://github.com/Beardhammer/CVE-2026-85884

红队技术

1、Defense Evasion: RecoverIt – Using Windows Service Failure Recovery to Evade Detection

https://hackers-arise.com/defense-evasion-recoverit-using-windows-service-failure-recovery-to-evade-detection/

https://github.com/TwoSevenOneT/RecoverIt

2、Living Off the Living Off the Land

http://lolol.farm/

3、Windows 11 26H2 ETW

https://jdu2600.github.io/Windows10EtwEvents/

4、DLL Injection with SetWinEventHook: The Accessibility Hook as an Injector

https://trainsec.net/library/windows-internals/dll-injection-with-setwineventhook-the-accessibility-hook-as-an-injector/

5、Bypassing AMSI & ETW: Building a Custom PowerShell Runspace in C

https://by7e.dev/blog/runspace

6、Shellcode Execution via CreateThreadpoolWait

https://medium.com/@s12deff/shellcode-execution-via-createthreadpoolwait-109d8c780d63

7、DLL Sideloading for Initial Access and Bypassing Elastic EDR

https://akchhat.gitbook.io/dev/initial-access/dll-sideloading-for-initial-access-and-bypassing-elastic-edr

蓝队技术

1、Sentinel

https://github.com/psihijatrija/Sentinel

Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.

2、Digital Forensics: Extracting Credentials with DeadMatter

https://hackers-arise.com/digital-forensics-evading-av-edr-during-credential-extraction-with-deadmatter/

3、1. HTTP/2 C2 Channel & Encrypted Screen Capture

https://github.com/kaandemir993/Overlord-RAT-Reverse-Engineering-a-Go-Based-RAT-Injection-Keylogging-C2-Exfiltration-Analysis

4、Stealing Plaintext Windows Credentials: LogonStealer

https://medium.com/@s12deff/stealing-plaintext-windows-credentials-logonstealer-26bbed6c3875

5、c2detect

https://github.com/cognis-digital/c2detect

C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

工具类

1、LogonStealer

https://github.com/S12cybersecurity/LogonStealer

Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks

2、NTDLL-reconstruction

https://github.com/sk4r4b/NTDLL-reconstruction

A technique that mixes NTDLL unhooking and hellsgate gate varients

3、Redteam BOFs

https://github.com/chryzsh/redteam-bofs

4、RuoyiScanX — 若依专项漏洞扫描工具

https://github.com/ZapcoMan/RuoyiScanX

5、ReflectivePluginLoader

https://github.com/racoten/ReflectivePluginLoader

Reflective PE mapper and evasion-hardened module stomping engine for Windows x64

6、Cuban Eight

https://github.com/shaheeryasirofficial/cuban-eight

Cuban Eight is a red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer. Double-click to deploy.

7、TornadoC2

https://github.com/kamalx06/TornadoC2

Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64.

其他类

1、