#Sysinternals

Christoffer S.nopatience@swecyb.com
2025-04-07

(gdatasoftware.com) Analysis of Vidar Stealer Masquerading as Microsoft's BGInfo Tool

gdatasoftware.com/blog/2025/04

Credential stealers are all the rage, and have been for the last few years. They are continuously pushing small iterative innovation steps towards obfuscation and increasing their chances of remaining undetected just long enough for them to do their thing.

G Data analyzed a recent sample of Vidar that appears to have "infected" a legitimate Microsoft sysinternals tool called BGInfo. Expired digital signatures and other tell-tell signs, but nonetheless a very low level of detection on VT, only 5 at the time of analysis.

#Cybersecurity #ThreatIntel #Vidar #Stealer #Sysinternals

2025-02-18

EPISODE 10 - Scott & Mark Learn To... Zoomit with Scott Hanselman & Mark Russinovich | Wed at 12:15pm EST. https://www.youtube.com/watch?v=8WEoZ646Ikk #zoomit #sysinternals #windows #devtools

EPISODE 10 - Scott & Mark Lear...

Alvin Ashcraft 🐿️alvinashcraft@hachyderm.io
2025-02-18

EPISODE 10 - Scott & Mark Learn To... Zoomit with Scott Hanselman & Mark Russinovich | Wed at 12:15pm EST.

youtube.com/watch?v=8WEoZ646Ik

#zoomit #sysinternals #windows #devtools

2025-01-31

#BSI WID-SEC-2025-0231: [NEU] [UNGEPATCHT] [mittel] #Microsoft #SysInternals: Schwachstelle ermöglicht Codeausführung

Ein lokaler Angreifer kann eine Schwachstelle in Microsoft SysInternals ausnutzen, um beliebigen Programmcode auszuführen.

wid.cert-bund.de/portal/wid/se

Alvin Ashcraft 🐿️alvinashcraft@hachyderm.io
2024-12-17

ZoomIt v9.0 from Sysinternals.

This release adds drawing and annotation on top of live windows and the desktop.

techcommunity.microsoft.com/bl
#windows #powerusers #sysinternals #utilities

kurtshkurtsh
2024-12-16

Announcing ZoomIt v9.0 with LiveDraw and LiveZoom

No more freezing before sketching/writing. Now you can write/draw on the Windows desktop & over applications that are actively moving on the screen.

And it's still free! 😁

techcommunity.microsoft.com/bl

Alvin Ashcraft 🐿️alvinashcraft@hachyderm.io
2024-12-10

Premiering tomorrow: EPISODE 6 - Scott & Mark Learn To... Take a Dump.

buff.ly/3ZwJETv
#podcast #devcommunity #programming #productivity #debugging #windowsdev #sysinternals

TiTiNoNero :__:77nn@goto.77nn.it
2024-12-05

Today I'm really pissed off.

The website of my #remote #desktop management application of choice has been blocked by our corporate's policies, therefore I can't download any more updates for it...

So this application is unsafer by a tiny bit every day new versions are not installed and I cannot guarantee, under my responsibility, that it is being stewarded (...updated, assessed...) correctly. So I can only remove it from my system.

Why don't I use a single RDP server and access all the others via console? Yes I do it for most of the job, but sometimes you've got to see what it feels like, you need to launch installers, applications and graphical tools that all the #Powershell of the world can't give you a feedback about.

Why don't I use #RDM by #Sysinternals? Because I can't do it properly, as some specific settings on our environment makes it unusable. Well, I could use it if I really wanted to script the remote servers creation phase, injecting the extra settings needed by the .rdp files, but...

Fuck you! I refuse

I will not do this. I will just keep a folder where I'll add a new .rdp file, manually crafted, every time I need to access one of my more than 700 supported Windows servers. It will take an insane amount of time, but this is how my company wants to spend their money, otherwise they would have provided me with the same capability they brought me away.

I was so pissed off that without realizing I built my menu-based RDM app from ground up in Powershell, and I'm going to share it on #Codeberg in the next days.

* List servers in a .csv file with some properties
* Pattern-search or filter the list by properties
* Connect to a server via mstsc
* Generate the .rdp for a server
* Add (or update) a server to the list
* Remove a server from the list
* Keeps track of last connection timestamp and connection count for each server
Select command: (<C>onnect, <G>enerate .rdp, <L>ist, <A>dd, <R>emove, e<X>it)?
2024-10-29

Wprowadzenie do Sysinternals – PSTools/PsExec

W pracy z systemami Windows kluczowy jest dostęp do narzędzi umożliwiających zdalną administrację. Choć nowoczesne rozwiązania, takie jak PowerShell Remoting, dobrze spełniają te funkcje, ich wykorzystanie często jest ograniczone przez polityki bezpieczeństwa lub rozwiązania EDR (Endpoint Detection & Response – wykrywanie i reagowanie w punktach końcowych). W takich sytuacjach można...

#Narzędzia #Teksty #Narzędzia #Psexec #Pstools #Sysinternals #Windows

sekurak.pl/wprowadzenie-do-sys

2024-10-12

The first of three blog posts around automating debugging in #Windows with Perfmon, Wireshark, and ProcMon. #powershell #itpro #sysadmin #configmgr #sysinternals

potentengineer.com/2024/10/12/

Özkan Pakdil 🦖thejvmbender@techhub.social
2024-08-15

I know #Sysinternals around 15 years now, and I use process explorer for my daily use, it is better than windows task manager, anyway today I learned that they have procdump, and it is actually open source for #linux, and it is pretty popular 3k stars in GitHub, then I was wondering if I can find gcgen option for windows @mariohewardt said they will consider it, I think it will be easier for customers to have procdump instead of dotnet-gcdump or opening task manager and generating the dump from it :blobcathappy:

github.com/Sysinternals/ProcDu

2024-08-06

Wprowadzenie do Sysinternals – Process Explorer

Windowsowy Menedżer zadań jest pierwszym narzędziem, po które sięgamy, gdy chcemy rozwiązać problem z działaniem danego programu. W Task Managerze możemy zobaczyć procesy systemu, uruchomione usługi i aplikacje, a także możemy nimi zarządzać w najbardziej podstawowym zakresie. Jeśli chcielibyśmy precyzyjnie ustalić szczegóły działania programów, np. przejrzeć listę zasobów przydzielonych do...

#Narzędzia #Teksty #Narzędzia #Processexplorer #Sysinternals #Windows

sekurak.pl/wprowadzenie-do-sys

2024-07-31

Wprowadzenie do Sysinternals – Autoruns

Autoruns z pakietu Sysinternals skanuje system, w tym rejestr i foldery systemowe, w poszukiwaniu oprogramowania, które uruchamia się automatycznie, przykładowo podczas startu systemu (ale nie tylko). Znalezione elementy wypisywane są w tabeli wraz z dodatkowymi informacjami, pomagającymi zrozumieć, jaki program jest uruchamiany, z jakiej przyczyny, jaki jest stan jego podpisów...

#Narzędzia #Teksty #Autorun #Autoruns #Narzędzia #Sysinternals #Windows

sekurak.pl/wprowadzenie-do-sys

2024-07-26

Wprowadzenie do Sysinternals Suite

Sysinternals Suite to zestaw ponad 70 darmowych narzędzi, za pomocą których można zajrzeć w najgłębsze zakamarki Windowsa (częściowo również Linuksa), analizować uruchomione procesy, badać aktywność sieciową, monitorować zmiany w plikach czy też w rejestrze. W związku z tym programy Sysinternals cieszą się dużym uznaniem wśród administratorów IT, pentesterów i informatyków śledczych, ale oczywiście nie uchodzą one też uwadze cyber-zbójom.

#Narzędzia #Teksty #Microsoft #Narzędzia #Sysinternals #Windows

sekurak.pl/wprowadzenie-do-sys

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst