David Fletcher

Author, David Fletcher, Phishing, Red Team Empire, Macro, macro malware, OSX, PowerShell, Windows

How To: Empire’s Cross Platform Office Macro

David Fletcher // During our testing, we encounter organizations of various different sizes, shapes, and composition.  One that we’ve run across a number of times includes a fairly even mixture […]

Read the entire post here

Author, David Fletcher, External/Internal, Red Team, Red Team Tools network traffic, Network Vulnerabilities, NetworkRecon.ps1, tools

How to Identify Network Vulnerabilities with NetworkRecon.ps1

David Fletcher //   Whenever I have the opportunity, I like to perform packet collection on a test for about five minutes so I can analyze the results and look […]

Read the entire post here

Author, C2, David Fletcher, Red Team anti-virus, AV, bypassing AV, Cylance, Cylance Bypass, metasploit meterpreter, PowerShell, PowerShell Empire Agent

Bypassing Cylance: Part 4 – Metasploit Meterpreter & PowerShell Empire Agent

David Fletcher // The following techniques serve to illustrate methods for obtaining C2 communication in a particular Cylance protected environment.  The configuration of the centralized infrastructure and the endpoint agents […]

Read the entire post here

Author, C2, David Fletcher, Red Team anti-virus, AV, AV bypass, bypassing AV, bypassing Cylance, Cylance, Ncat, netcat, Nishang, Nishang ICMP C2 Channel

Bypassing Cylance: Part 3 – Netcat & Nishang ICMP C2 Channel

David Fletcher // The following techniques serve to illustrate methods for obtaining C2 communication in a particular Cylance protected environment.  The configuration of the centralized infrastructure and the endpoint agents […]

Read the entire post here

Author, C2, David Fletcher, Red Team anti-virus, AV, AV bypass, Cylance, Cylance Bypass, dnscat2, Pentesting

Bypassing Cylance: Part 2 – Using DNSCat2

David Fletcher // The following techniques serve to illustrate methods for obtaining C2 communication in a particular Cylance protected environment.  The configuration of the centralized infrastructure and the endpoint agents […]

Read the entire post here

Author, C2, David Fletcher, Red Team anti-virus, AV, bypassing AV, bypassing Cylance, Cylance, VSAgent.exe

Bypassing Cylance: Part 1 – Using VSAgent.exe

David Fletcher // Recently, we had the opportunity to test a production Cylance environment. Obviously, each environment is going to be different and the efficacy of security controls relies largely […]

Read the entire post here

Author, C2, David Fletcher, Red Team Apple, Install, Mac, Malware, phishing

How to Phish for Geniuses

David Fletcher // Recently we were involved in an engagement where we expected to see a large number of Macs in the target environment. As an element of the engagement […]

Read the entire post here

Author, Blue Team, David Fletcher, Red Team Blue Team, Conference Talk, GrrCon, Purple Team, Red Team, Red Team vs. Blue Team

Red + Blue = Purple

David Fletcher & Sally Vandeven // We gave a presentation at the GrrCon hacker conference in Grand Rapids, MI on October 6, 2016. The presentation was a dialogue meant to illustrate the […]

Read the entire post here

Author, David Fletcher, Red Team pentest reporting, pentest reports, Pentesting, red team life, reporting, technical writing, writing

How to Not Suck at Reporting (or How to Write Great Pentesting Reports)

David Fletcher // Reporting is a penetration testing topic that doesn’t have a whole lot of popularity. People have a hard time being inspired to write about the technical details of […]

Read the entire post here