Artículos publicados por Julian Horoszkiewicz
A tale of several hijacks and what it taught me about runtime-driven testingThis article walks through a series of recently discovered file-hijacking issues in widely used software. I break down the root causes: default OS permission...Attacking local self-protection mechanisms – a case study of CVE-2019-3613 and CVE-2022-3859Introduction to Trellix CVE 2022-3859On 29th November Trellix (former McAfee) released a security bulletin addressing an issue tracked as CVE-2022-3859, whic...Creating persistent local privilege escalation with temporarily elevated legitimate installersThe interesting case of WinSCPA couple of months ago, while analyzing one of our environments, we had noticed instances of the LogonUI.exe process – running...Roaming and racing to get SYSTEM – CVE-2023-37250IntroductionIn my previous blog post (Creating Persistent Local Privilege Escalation with Temporarily Elevated Legitimate Installers) I mentioned potential l...Using EDR telemetry for offensive researchAbout EDREDR – Endpoint Detection and Response – is a type of security solution, with agents running on endpoints (workstations, servers, etc.). Its first ro...Making Vulnerable Drivers Exploitable Without Hardware – The BYOVD Perspective1. IntroductionThis article provides a technical analysis of how many Windows kernel mode drivers can be interacted with from user mode without the hardware...Anatomy of access: Windows device objects from a security perspectiveTable of contents1. Introduction2. Device objects as the most viable kernel attack vector3. Accessing device objects3.1. Standard pattern3.2. Accessing devic...