Hard Active Directory box exploiting anonymous LDAP access and AD CS ESC1 misconfiguration
Medium difficulty defense evasion box featuring a scheduled task privilege escalation vector
In this project, I executed a custom, low profile mTLS C2 beacon on a fully patched Windows 11 endpoint that did not trigger Windows Defender. I then examined how this activity appeared across endpoint telemetry in Wazuh and network telemetry in Security Onion.
In this project, I executed a custom, low profile mTLS C2 beacon on a fully patched Windows 11 endpoint that did not trigger Windows Defender. I then examined how this activity appeared across endpoint telemetry in Wazuh and network telemetry in Security Onion.