From ddb2282e0a47e1b1260ca1f5fe481987a4bc8fcc Mon Sep 17 00:00:00 2001 From: "Mariusz B. / mgeeky" Date: Wed, 13 Jul 2022 22:44:17 +0200 Subject: [PATCH] update --- red-teaming/Self-Signed Threat/README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/red-teaming/Self-Signed Threat/README.md b/red-teaming/Self-Signed Threat/README.md index 10b3c5b..f817546 100644 --- a/red-teaming/Self-Signed Threat/README.md +++ b/red-teaming/Self-Signed Threat/README.md @@ -2,9 +2,10 @@ A Powershell script that signs input Executable file with fake Microsoft code-signing certificate to demonstrate risks of Code Signing attacks. -Script was borrowed from [Matt Graeber, @mattifestation](https://twitter.com/mattifestation) and his [_Code Signing Certificate Cloning Attacks and Defenses_](https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec) and **all credits are his**. +Script was shamelessly borrowed from [Matt Graeber, @mattifestation](https://twitter.com/mattifestation) and his research titled [_Code Signing Certificate Cloning Attacks and Defenses_](https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec) +**All credits go to Matt** - I merely copied it preserverance purposes. -As of 13/07/2022 this dumb trick still gets off the shelf malware evade detection of at least 8 modern security scanners. +As of 13/07/2022 this **dumb trick** still gets off the shelf malware evade detection of at least 8 modern security scanners. | What | Result | |------------------------------------------------------------------------------|-----------|