[NextSoftGroup]

Hidden Content

You must register or login to view this content.

To see how to pipe a SYSTEM-level Reverse Shell through GodPotato without touching the disk, please Like and Reply to this thread!

---

5. How to: Defend & Detect

• Privilege Least-Requirement: Audit service accounts and remove
  SeImpersonatePrivilege
  where it isn't strictly necessary.
  
• RPC/DCOM Monitoring: Monitor for unusual local RPC connections or DCOM object activations originating from low-privilege service accounts.
  
• ASR Rules: Implement Windows Attack Surface Reduction (ASR) rules to block process creations originating from compromised service accounts.
  

6. Resources

• MITRE ATT&CK: T1134.001 - Access Token Manipulation: Token Impersonation
  
• Project Source: GitHub - BeichenDream/GodPotato
  [/hide]
  

[nettspend2]

3tegefdvfdsdxcbdffg

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.

[Fanatik]

Thanks for sharing, that's nice.
Thanks for sharing, that's nice.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.