Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
Malicious Service
Malicious Service A malicious service is a system service that an attacker has either created from scratch or modified after gaining access to a machine. The goal is simple: survive reboots and keep…
Malicious Firmware
Malicious Firmware Firmware is the low-level software baked into hardware - your BIOS, UEFI, network cards, video cards, and more. It runs before the operating system even loads, which makes it…
Malicious Driver
Malicious Driver A malicious driver is a device driver that has been installed or tampered with by an attacker to maintain control over a system - even after it reboots. Because drivers run at the…
Malicious Browser Plugins
Malicious Browser Plugins Browser plugins - also called extensions - are small pieces of software that add functionality to your browser. They can do a lot of useful things, like blocking ads or…
Logon Scripts
Logon Scripts Every time a user logs into a system, the OS can automatically run a set of scripts. These are called logon scripts , and they exist for legitimate reasons - pushing software, mapping…
shimgen
ShimGen — Masquerading & Proxy Execution Windows & Ubuntu VM The objective of this lab is to use ShimGen to generate a weaponized proxy executable that visually and functionally impersonates a…
sharpstayPER
SharpStay Finished? Back to Card's Main Page
sharpersist
SharPersist Windows VM In this lab we will Understand what persistence means and why attackers use it Add a persistence entry via the Registry Run key Add a persistence entry via a Scheduled Task Add…
sdb explorer
SDB-Explorer Windows & Ubuntu VM The objective of this lab is to use Application Shimming (via the native sdbinst.exe utility) to silently inject a demonstration DLL into a custom 32-bit application,…
psexec
PsExec In this lab we will Use a Linux VM as the attacker Use a Windows VM as the target Run PsExec-style remote execution with Impacket Execute commands on the Windows target over SMB Understand how…
powershell
This is a lab from John Strand 's SOC Core Skills Course: https://www.antisyphontraining.com/product/soc-core-skills-with-john-strand/ PowerShell Windows VM In this lab, we will create malware , run…
impacket
Impacket Ubuntu VM In this lab we will Stand up a local SMB server (Samba) as our "target" Use Impacket to: List SMB shares Browse directories Upload and download files (Optional) query basic SMB/RPC…