Archeotech - The Archive: com

Bookmarks for `com`

28 bookmarks — 28 scraped, 28 summarized, 0 pending

URL	View
Fantastic RPC Interfaces and How to Find Them \| Akamai https://www.akamai.com/blog/security-research/rpc-toolkit-fantastic-interfaces-how-to-find Looking for your next security research project? Our RPC Interface Analyzer tool can help you find it.	View Summary
Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343) https://blog.calif.io/p/dark-elevator-windows-install-service A pure-logic, 100% reliable path from a normal user to SYSTEM	View Summary
COMouflage: Stealthy DLL Surrogate Injection for Process Tree Evasion https://core-jmp.org/2026/04/comouflage-stealthy-dll-surrogate-injection-for-process-tree-evasion/ COMouflage is a stealthy Windows injection technique that abuses COM DLL Surrogates to execute malicious DLLs inside dllhost.exe, making svchost.exe appear as the parent process and hiding the attacker’s process from detection.	View Summary
DCOM Explained: How Attackers Turn a Windows Feature into a Lateral Movement Tool https://core-jmp.org/2026/06/dcom-lateral-movement-detection-explained/ Distributed COM (DCOM) lets one Windows host instantiate and drive COM objects on another over the network — and that same capability is a favourite lateral-movement primitive. This walkthrough covers the DCOM architecture, a step-by-step attack flow from a dumped credential to a child PowerShell process, and the correlated Event ID 4624 and Sysmon telemetry…	View Summary
Forget PSEXEC: DCOM Upload & Execute Backdoor https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor Join Deep Instinct Security Researcher Eliran Nissan as he exposes a powerful new DCOM lateral movement attack that remotely writes custom payloads to create an embedded backdoor., Join Deep Instinct Security Researcher Eliran Nissan as he exposes a powerful new DCOM lateral movement attack that remotely writes custom payloads to create an embedded backdoor.	View Summary
RPC interfaces dump August 2018 · GitHub https://gist.github.com/enigma0x3/092da9f249499391adffe2c46abfa1a1 RPC interfaces dump August 2018. GitHub Gist: instantly share code, notes, and snippets.	View Summary
RPC interfaces dump August 2018 · GitHub https://gist.github.com/enigma0x3/092da9f249499391adffe2c46abfa1a1#file-rpc_dump_august-txt-L336 RPC interfaces dump August 2018. GitHub Gist: instantly share code, notes, and snippets.	View Summary
GitHub - An0nUD4Y/Offensive-COM: Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijacking, elevation of privilege, DCOM lateral movement, and persistence primitives with exploitation steps. Notes were generated by Kimi K3 Swarm may contain inaccuracies. · GitHub https://github.com/An0nUD4Y/Offensive-COM Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijacking, elevation of privilege, DCOM lateral movement, and persistence primitives with exploitation steps. Notes were generated by Kimi K3 Swarm may contain inaccuracies. - An0nUD4Y/Offensive-COM	View Summary
GitHub - cyberark/RPCMon: RPC Monitor tool based on Event Tracing for Windows https://github.com/cyberark/RPCMon RPC Monitor tool based on Event Tracing for Windows - cyberark/RPCMon	View Summary
GitHub - DylanDavis1/DSCourier: DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries. · GitHub https://github.com/DylanDavis1/DSCourier DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries. - DylanDavis1/DSCourier	View Summary
GitHub - HullaBrian/COMmander: .NET tool used to enrich RPC telemetry https://github.com/HullaBrian/COMmander?tab=readme-ov-file .NET tool used to enrich RPC telemetry. Contribute to HullaBrian/COMmander development by creating an account on GitHub.	View Summary
GitHub - rtecCyberSec/BitlockMove: Lateral Movement via Bitlocker DCOM interfaces & COM Hijacking https://github.com/rtecCyberSec/BitlockMove Lateral Movement via Bitlocker DCOM interfaces & COM Hijacking - rtecCyberSec/BitlockMove	View Summary
GitHub - T3nb3w/ComDotNetExploit: A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases bypassing code integrity checks and loading malicious payloads in highly protected processes such as LSASS. Based on research from James Forshaw. https://github.com/T3nb3w/ComDotNetExploit A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases bypassing code integrity checks and loading malicious payloads in highly protected processes such as LSASS. Based on research from James Forshaw. - T3nb3w/ComDotNetExploit	View Summary
GitHub - xforcered/ForsHops: ForsHops https://github.com/xforcered/ForsHops ForsHops. Contribute to xforcered/ForsHops development by creating an account on GitHub.	View Summary
GitHub - zero2504/COMouflage: COM-based DLL Surrogate Injection https://github.com/zero2504/COMouflage COM-based DLL Surrogate Injection. Contribute to zero2504/COMouflage development by creating an account on GitHub.	View Summary
WSL, COM Hooking, & RTTI. Introduction \| by Jonathan Johnson \| Medium https://jonny-johnson.medium.com/wsl-com-hooking-rtti-3abbf873d61f WSL, COM Hooking, & RTTI Introduction Recently I ran across a situation where I needed to get telemetry on the COM method CreateLxProcess’s invocation. One of the main ways to do this is by …	View Summary
CLSID Key - Win32 apps \| Microsoft Learn https://learn.microsoft.com/en-us/windows/win32/com/clsid-key-hklm A CLSID is a globally unique identifier that identifies a COM class object. If your server or container allows linking to its embedded objects, you need to register a CLSID for each supported class of objects.	View Summary
Initializing the COM Library - Win32 apps \| Microsoft Learn https://learn.microsoft.com/en-us/windows/win32/learnwin32/initializing-the-com-library Initializing the COM Library	View Summary
COM, DCOM, and Type Libraries - Win32 apps \| Microsoft Learn https://learn.microsoft.com/en-us/windows/win32/midl/com-dcom-and-type-libraries Component Object Model (COM) and Distributed Component Object Model (DCOM) use Remote Procedure Calls (RPC) to enable distributed component objects to communicate with each other.	View Summary
The Unseen Magic of COM https://www.linkedin.com/pulse/unseen-magic-com-steven-dejean-o7ipf Most Windows users interact with COM every day, whether they know it or not. Actions like embedding Excel into Word documents, using right-click options like “Add to archive” or “Scan with Bitdefender,” and even copying and pasting content across applications, all rely on the Component Object Model	View Summary
COMegon: Putting Beacons to Bed with COM Internals \| maldev.lol https://maldev.lol/posts/comegon-putting-beacons-to-bed-with-com-internals/	View Summary
https://mohamed-fakroud.gitbook.io/red-teamings-dojo/abusing-idispatch-for-trapped-com-object-access-and-injecting-into-ppl-processes	View Summary
The Key to COMpromise - Pwning AVs and EDRs by Hijacking COM Interfaces, Part 1 — Neodyme https://neodyme.io/en/blog/com_hijacking_1/	View Summary
The Key to COMpromise - Pwning AVs and EDRs by Hijacking COM Interfaces, Part 1 — Neodyme https://neodyme.io/en/blog/com_hijacking_1/#hijacking-a-com-interface	View Summary
Blog Revisiting Cross Session Activation Attacks - r-tec Cyber Security https://www.r-tec.net/r-tec-blog-revisiting-cross-session-activation-attacks.html This blog post revisits Cross Session Activation attacks	View Summary
Blog Windows is and always will be a Potatoland - r-tec Cyber Security https://www.r-tec.net/r-tec-blog-windows-is-and-always-will-be-a-potatoland.html This blog post will dive into the world of some of the recently published potato techniques that can lead to more serious risks than "just" local Privilege Escalation.	View Summary
Revisiting COM Hijacking - SpecterOps https://specterops.io/blog/2025/05/28/revisiting-com-hijacking/ Learn how to use COM hijacking for persistence and post-exploitation by targeting commonly used applications in Windows environments.	View Summary
Dissecting DCOM part 1 https://www.synacktiv.com/en/publications/dissecting-dcom-part-1 Dissecting DCOM part 1	View Summary

Bookmarks for com

Bookmarks for `com`