PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dissecting Impacket for Good and Bad

abdulmhsblog.com | blog | #active-directory | #kerberos | #smb | #red-team | #blue-team | #detection | #ioc | #impacket | #network-forensics
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Rewriting Impacket internally led the author to publish Impacket-IoCs, 72+ protocol-level detection indicators, after finding most public detections rely on easily changed service names and artifacts.
Published
Collected

Related coverage

blog · netspi.com
Prioritizing the Remediation of Mitre ATT&CK Framework Gaps
Scott Sutherland offers tips for prioritizing detective control gaps found through adversarial simulation with MITRE ATT&CK, helping blue teams triage findings and build a detection baseline.
blog · netspi.com
Common Red Team Techniques vs Blue Team Controls Infographic
Shares an infographic mapping common red team phishing attack workflows to blue team detective and preventative controls, plus practical stealth tips for both offensive operators and defenders.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
vulnerability · horizon3.ai
From CVE-2022-33679 to Unauthenticated Kerberoasting
On September 13, 2022, a new Kerberos vulnerability was published on the Microsoft Security Response Center’s security site. It’s labeled as a Windows Kerberos…
blog · abdulmhsblog.com
Implementing Impacket's Newest Protocol: MS-RAA
A walkthrough of implementing MS-RAA (Remote Authorization) as a new Impacket module, covering how the RPC protocol simulates access control decisions to answer what a principal can actually access.
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
Back