Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
Site Walkthrough
Site Walkthrough A site walkthrough is when the defenders physically go to the location being investigated. They walk through the space, inspect hardware, check logs on-site, and look for anything…
Physical Security Review
Physical Security Review Physical security is what stands between an attacker and the hardware, people, and data inside a building. When people think about hacking, they usually picture someone behind…
Physical Medium as Exfil
Physical Medium as Exfil Data exfiltration does not always happen over the internet. Sometimes, the simplest way to steal data is to walk out with it. Physical medium exfiltration is exactly that -…
New User Added
New User Added When attackers get into a system, their first concern is staying in. One of the simplest ways to do that is creating a new user account - one they control, one that blends in, and one…
Malicious Service
Malicious Service A malicious service is a system service that an attacker has either created from scratch or modified after gaining access to a machine. The goal is simple: survive reboots and keep…
Malicious Firmware
Malicious Firmware Firmware is the low-level software baked into hardware - your BIOS, UEFI, network cards, video cards, and more. It runs before the operating system even loads, which makes it…
Malicious Driver
Malicious Driver A malicious driver is a device driver that has been installed or tampered with by an attacker to maintain control over a system - even after it reboots. Because drivers run at the…
Malicious Browser Plugins
Malicious Browser Plugins Browser plugins - also called extensions - are small pieces of software that add functionality to your browser. They can do a lot of useful things, like blocking ads or…
Logon Scripts
Logon Scripts Every time a user logs into a system, the OS can automatically run a set of scripts. These are called logon scripts , and they exist for legitimate reasons - pushing software, mapping…
shimgen
ShimGen — Masquerading & Proxy Execution Windows & Ubuntu VM The objective of this lab is to use ShimGen to generate a weaponized proxy executable that visually and functionally impersonates a…
sharpstayPER
SharpStay Finished? Back to Card's Main Page
sharpersist
SharPersist Windows VM In this lab we will Understand what persistence means and why attackers use it Add a persistence entry via the Registry Run key Add a persistence entry via a Scheduled Task Add…