Open in app

Sign In

Write

Sign In

Jonathan Johnson
Jonathan Johnson

629 Followers

Home

About

Jul 21

ThreadSleeper: Suspending Threads via GMER64 Driver

Originally posted: https://www.binarydefense.com/resources/blog/threadsleeper-suspending-threads-via-gmer64-driver/ Recently a friend of mine, Nick Powers, sent me the gmer.sys driver that was involved with the Blackout activity which exposed functionality to terminate any process you wanted from a medium integrity level context. This was being used against many EDR vendors, including Microsoft Defender for Endpoint…

Malware

8 min read

ThreadSleeper: Suspending Threads via GMER64 Driver
ThreadSleeper: Suspending Threads via GMER64 Driver
Malware

8 min read


Jun 12

Understanding Telemetry: Kernel Callbacks

Introduction I’ve published blogs around telemetry mechanisms like Event Tracing for Windows (ETW) in the Uncovering Windows Events series, but one mechanism I haven’t discussed yet are kernel callback functions. …

Research

9 min read

Understanding Telemetry: Kernel Callbacks
Understanding Telemetry: Kernel Callbacks
Research

9 min read


May 3

Exploring Impersonation through the Named Pipe Filesystem Driver

Introduction Impersonation happens often natively in Windows, however, adversaries also use it to run code in the context of another user. Recently I was researching named pipe impersonation which naturally led me digging into the Win32 API ImpersonateNamedPipeClient. I had never really dug into how ImpersonateNamedPipeClient worked under the hood, so…

Windows

9 min read

Exploring Impersonation through the Named Pipe Filesystem Driver
Exploring Impersonation through the Named Pipe Filesystem Driver
Windows

9 min read


Mar 15

Uncovering Windows Events

Threat Intelligence ETW — Not all manifest-based Event Tracing for Windows (ETW) providers that are exposed through Windows are ingested into telemetry sensors/EDR’s. One provider commonly that is leveraged by vendors is the Threat-Intelligence ETW provider. …

Windows Internals

6 min read

Uncovering Windows Events
Uncovering Windows Events
Windows Internals

6 min read


Published in

Posts By SpecterOps Team Members

·Feb 10

Telemetry Layering

Introduction Creating detections can be challenging. There often isn’t a “simple” way to detect something, and once we see an event that seems to correlate with the activity we are looking for, it is easy to become fixated. We create that detection and move on. However, what if other telemetry sources…

Detection Engineering

8 min read

Telemetry Layering
Telemetry Layering
Detection Engineering

8 min read


Published in

Posts By SpecterOps Team Members

·Jan 18

The Defender’s Guide to Windows Services

It’s dangerous to find malicious services alone! Take this! — Authors: Luke Paine & Jonathan Johnson Introduction This is the second installment of the Defender’s Guide series. In keeping with the theme, we are discussing Windows Services, the underlying technology, common attack vectors, and methods of securing/monitoring them. Services are an important part of the Windows operating system, allowing the control and configuration of long-running processes essential…

Detection Engineering

10 min read

The Defender’s Guide to Windows Services
The Defender’s Guide to Windows Services
Detection Engineering

10 min read


Dec 14, 2022

Uncovering Windows Events

Part 2: The Methodology — In part 1 of this series, I touched on how data is the foundation for defensive capabilities and the importance for defenders to understand where and how telemetry is being generated. …

Windows

4 min read

Uncovering Windows Events
Uncovering Windows Events
Windows

4 min read


Nov 14, 2022

Uncovering Windows Events

Part 1: TelemetrySource — Data is the foundation by which defense is built upon. This data can come from various telemetry sources — native logging, Endpoint Detection and Response (EDR) tools, network logging, etc. The data from these sources give us insight into activity happening with a given machine — user’s logging in, processes…

Windows

6 min read

Uncovering Windows Events
Uncovering Windows Events
Windows

6 min read


Sep 12, 2022

WMI Internals Part 3

Beyond COM — In a previous blog post of mine — WMI Internals Part 2: Reversing a WMI Provider I walked through how the WMI architecture is foundationally built upon COM and in turn how WMI classes can end up invoking COM methods to perform actions. …

Windows

6 min read

WMI Internals Part 3
WMI Internals Part 3
Windows

6 min read


Aug 15, 2022

WMI Internals Part 2

Reversing a WMI Provider — In a previous post WMI Internals Part 1: Understanding the Basics I walked through some of the basic internal information behind WMI. …

Windows

6 min read

WMI Internals Part 2
WMI Internals Part 2
Windows

6 min read

Jonathan Johnson

Jonathan Johnson

629 Followers

Consultant @SpecterOps | Host @DCPThePodcast | Defensive Security Researcher

Following
  • Matt Hand

    Matt Hand

  • Palantir

    Palantir

  • Andy Robbins

    Andy Robbins

  • Justin Bui

    Justin Bui

  • Yarden Shafir

    Yarden Shafir

See all (29)

Help

Status

Writers

Blog

Careers

Privacy

Terms

About

Text to speech

Teams