2026-11-01 01:10:00 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

攻防技战术动态一周更新 - 20261026

原创

红蓝对抗技术
红蓝对抗技术

红蓝对抗技战术

2026年10月31日 19:44
北京

去阅读

漏洞相关

1、PHP2Shell

https://github.com/devploit/php2shell

红队技术

1、EDR Evasion: Process Injection Without WriteProcessMemory

https://www.zerosalarium.com/2026/09/edr-evasion-process-injection-without-WriteProcessMemory.html?m=1

2、Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform

https://www.elastic.co/security-labs/blog/windows-endpoint-security-platform-wesp

3、Inventory of what PatchGuard watches

https://github.com/S12cybersecurity/WhatPatchguardProtects/

4、Runtime Credential Guard Deactivation

https://medium.com/@s12deff/runtime-credential-guard-deactivation-d01cb9eb0062

5、BusyWork: Replacing Sleep with Real Work to Break Behavioral Detection

https://patchi.fyi/blog/busywork-sleep-replacement

6、Active Directory Pentesting Methodology

https://karrab7.com/articles/Active-Directory-Pentesting-Methodology

7、PTE Manipulation and IRP Dispatch Hijacking to Execute Shellcode in Kernel

https://medium.com/@s12deff/pte-manipulation-and-irp-dispatch-hijacking-to-execute-shellcode-in-kernel-87e0d2dc4449

蓝队技术·

1、

工具类

1、unthemidator

http://github.com/x86rc/unthemidator

An automated Themida / Code Virtualizer / WinLicense (v3.0-v4) unpacker and dump fixer tool

2、ldap3-ad-auth

https://github.com/dirkjanm/ldap3-ad-auth

packaged ldap3 adapter for NTLM/Kerberos signing and channel binding

3、NtObjExplorer

https://github.com/KRR1751/NtObjExplorer

Custom Windows Driver that let you have an access to the NT Native Paths

3、NMG - .NET Memory-shell Generator

https://github.com/baguette168/nmg

4、PngLoader — Steganographic Payload Research

https://github.com/i014n/PngLoader

5、The Architecture of Stealth: Linux Malware Techniques

https://github.com/akazemi67/LinuxMalwareTechniques

6、TpDirectCallbackHijack

https://github.com/Maldev-Academy/TpDirectCallbackHijack

Remote process injection via TP\_DIRECT.Callback hijack

7、In-memory execution of VBScript, JavaScript or JScript

https://gist.github.com/odzhan/d18145b9538a3653be2f9a580b53b063

8、WhisperHijack

https://github.com/Maldev-Academy/WhisperHijack

A stealthy process injection PoC combining Thread Name-Calling for payload delivery with Waiting Thread Hijacking for execution, with zero cross-process writes.

9、ScatterSteg

https://github.com/mijnog/scattersteg

Encrypted steganography for PNG and JPEG images. Alternative to steghide

10、1. Binary Ninja – Open-Source Imitation & String Obfuscation

https://github.com/kaandemir993/NWH-Stealer-Analysis-Fileless-Bun-Runtime-Execution-Clipboard-Image-Theft-Cloud-C2-AWS-R2-

Static analysis and payload extraction of NWH Stealer. Features deep dive into fileless execution via Bun JavaScript Runtime, in-memory clipboard image theft (image/png), and Cloud C2 exfiltration abusing AWS/Cloudflare R2.