2026-01-11 01:12:23 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： ThisweeklyupdatehighlightsRedTeamadvancementsincludingBOFloadersandevasiontechniquesagainstPatchGuardandcloudsandboxesalongsidenovelC2channelsviaSlackandSMTP.BlueTeamfocusfeaturesAIanalysisandYARArules.Notabletoolsincludein-memoryharvesterslikeSILPH,stealthyLinuxrootkits,phishingplatformApolloFish,andutilitiesforSPN-lessRBCDattacksandcredentialdumping,providingpractitionerswithmodernoperationalsecurityandexploitationcapabilities. 综合评分： 80 文章分类： 红队,安全工具,免杀,内网渗透

cover_image

攻防技战术动态一周更新 – 20260105

原创

红蓝对抗技术

红蓝对抗技战术

2026年1月10日 15:40 北京

漏洞相关

1、

红队技术

1、BOF Cocktails

https://rastamouse.me/bof-cocktails/

2、The New Chapter of Egress Communication with Cobalt Strike User-Defined C2

The New Chapter of Egress Communication with Cobalt Strike User-Defined C2

3、Yet Another DCOM Object for Command Execution Part 2

https://sud0ru.ghost.io/yet-another-dcom-object-for-command-execution-part-2/

4、Vectored Exception Handling Squared

https://fluxsec.red/vectored-exception-handling-squared-rust

https://github.com/0xflux/Vectored-Exception-Handling-Squared

5、云沙箱对抗方法

https://mp.weixin.qq.com/s/PFtssx37kwBKhgvc7dyZqw

6、Evasive Remote Memory Write

https://medium.com/@s12deff/evasive-remote-memory-write-22e6ddc89517

7、PatchGuard Peekaboo: Hiding Processes on Systems with PatchGuard in 2026

https://www.outflank.nl/blog/2026/01/07/patchguard-peekaboo-hiding-processes-on-systems-with-patchguard-in-2026/

蓝队技术

1、用 AI “杀死” 那个 VShell

https://mp.weixin.qq.com/s/N-GBWD6wNp4fp0LVZOo_ig

2、100 Days of YARA 2026

https://github.com/t3ft3lb/2026-100DaysofYARA

3、Evil on Schedule: Investigating Malicious Windows Scheduled Tasks

https://www.thedfirspot.com/post/evil-on-schedule-investigating-malicious-windows-tasks

工具类

1、SILPH: Stealthy In-Memory Local Password Harvester

https://github.com/almounah/silph

2、Remote BOF Runner

https://github.com/pard0p/Remote-BOF-Runner

Remote BOF Runner is a Havoc extension framework for remote execution of Beacon Object Files (BOFs) using a PIC loader made with Crystal Palace.

3、Slack UDC2 BOF

https://github.com/WKL-Sec/slack-udc2

Cobalt Strike UDC2 implementation that provides an Slack C2 channel

4、SessionView

https://github.com/lsecqt/SessionView

A portable C# utility for enumerating local and remote windows sessions

5、FsquirtCPLPoC

https://github.com/mhaskar/FsquirtCPLPoC

PoC for generating bthprops.cpl module designed to be loaded by Fsquirt.exe LOLBin

6、EvilNeko

https://github.com/CorvraLabs/EvilNeko

EvilNeko is a project to automate orchestration of containers and operationalize Browser in the Browser (BITB) attacks for red teams.

7、InlineExcuteEx

https://github.com/0xTriboulet/InlineExecuteEx

A BOF that’s a BOF Loader

8、IDontLikeFileLocks

https://github.com/EvilBytecode/IDontLikeFileLocks

Title is self explaining, well theres few methods we can do to read locked file and play with it…

9、DbgNexum – Shellcode Injection

https://github.com/dis0rder0x00/DbgNexum

10、Singularity – POC of Stealthy Linux Kernel Rootkit

https://github.com/MatheuZSecurity/Singularity

11、ApolloFish-阿波罗钓鱼演练平台

https://github.com/safe1024/apollofish

12、getSPNless

https://github.com/jarnovandenbrink/getSPNless

Python tool to automatically perform SPN-less RBCD attacks.

13、DumpBrowserSecrets

https://github.com/Maldev-Academy/DumpBrowserSecrets

16、Netexec Lab

https://github.com/Pennyw0rth/NetExec-Lab

17、DumpGuard BOF

https://github.com/0xedh/dumpguard_bof

Beacon Object File (BOF) port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems.

18、ClipboardStealBOF

https://github.com/incursi0n/ClipboardStealBOF

An alternative to the builtin clipboard feature in Cobalt Strike that adds the capability to enable/disable and dump the clipboard history.

20、📧 SMTP Tunnel Proxy

https://github.com/x011/smtp-tunnel-proxy

A high-speed covert tunnel that disguises TCP traffic as SMTP email communication to bypass Deep Packet Inspection (DPI) firewalls.

其他类

1、Using RDP without leaving traces: the MSTSC public mode

https://devolutions.net/blog/2025/03/using-rdp-without-leaving-traces-the-mstsc-public-mode/

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：红蓝对抗技战术红蓝对抗技术《攻防技战术动态一周更新 – 20260105》