文章总结： 这是一篇2025年12月发布的攻防技战术动态周报，汇总了最新的红蓝对抗技术和工具资源。红队技术部分介绍了恶意开发技巧、注册表操作、钓鱼技术和APC注入等；蓝队技术部分提供了CobaltStrike检测方法和恶意软件分析工具；工具类部分收录了包括Moonwalk++、byvalver等11个实用安全工具。这些资源为网络安全专业人员提供了最新的攻防技术参考和实用工具。
综合评分： 87
文章分类： 红队,漏洞分析,安全工具,渗透测试,恶意软件
攻防技战术动态一周更新 – 20251215
原创
红蓝对抗技术
红蓝对抗技战术
2025年12月20日 11:16
北京
漏洞相关
1、
红队技术
1、Malware development trick 47: simple Windows clipboard hijacking. Simple C example.
https://cocomelonc.github.io/malware/2025/05/10/malware-tricks-47.html
2、Malware Just Got Its Free Passes Back!
https://klezvirus.github.io/posts/Moonwalk-plus-plus/
3、Rehabilitating Registry Tradecraft with RegRestoreKey
https://www.originhq.com/blog/rehabilitating-registry-tradecraft-with-regrestorekey
4、ConsentFix: A New way to Phish for Tokens
https://newtonpaul.com/blog/consentfix-phishing-for-tokens/
5、Frankenstein APC Injection
https://medium.com/@s12deff/frankenstein-apc-injection-1007c24a0317
6、Malware development trick 53: steal data via legit XBOX API. Simple C example.
https://cocomelonc.github.io/malware/2025/10/22/malware-tricks-53.html
7、C2 workbench
https://www.c2workbench.com/
8、Managing Privileged Roles in Microsoft Entra ID: A Pragmatic Approach
https://trustedsec.com/blog/managing-privileged-roles-in-microsoft-entra-id-a-pragmatic-approach
蓝队技术
1、The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting Cobalt Strike in Open Directories
https://hunt.io/blog/guide-hunting-cobalt-strike-part-1-open-directories
2、Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns
Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns | Cyble
3、GoStringUngarbler
https://github.com/mandiant/gostringungarbler
Python tool to resolve all strings in Go binaries obfuscated by garble
工具类
1、Moonwalk++
https://github.com/klezVirus/Moonwalk–
Moonwalk++: Simple POC Combining StackMoonwalking and Memory Encryption
2、byvalver (·𐑚𐑲𐑝𐑨𐑤𐑝𐑼)
https://github.com/umpolungfish/byvalver
takes shellcode with bad-characters and banishes them, returning cleaned shellcode with preserved functionalities
3、ace_analyzer
https://github.com/vianic/ace_analyzer
ACE Analyzer for identifying ESC1-8 vulnerabilities (Written by AI)
4、SharpSCOM
https://github.com/breakfix/SharpSCOM
A C# utility for interacting with SCOM
5、Shellcode Signature Patcher
https://github.com/kypvas/shellcode-mutator
shellcode transformation tool for YARA evasion
6、Lamperlv3
https://github.com/P0142/Lamperlv3
Third iteration of Lamperl, a Linux agent for the Adaptix C2 being developed for a blog post.
7、FindAdminAccess
https://github.com/lsecqt/Find-AdminAccess
This C# tool sprays for admin access over the entire domain
8、SILPH: Stealthy In-Memory Local Password Harvester
https://github.com/almounah/silph
9、Tangled
https://github.com/ineesdv/Tangled
Open-source offensive security platform for conducting phishing campaigns that weaponizes iCalendar automatic event processing.
10、ESC1-unPAC BOF
https://github.com/RayRRT/ESC1-unPAC
A Beacon Object File (BOF) that performs the complete ESC1 attack chain in a single execution: certificate request with arbitrary SAN (+SID), PKINIT authentication, and NT hash extraction via UnPAC-the-hash.
11、VectoredOverloading
https://github.com/CheckPointSW/VectoredOverloading
Vectored Overloading is a local PE injection technique that was first observed in the KidKadi malware.
其他类
1、
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：红蓝对抗技战术 红蓝对抗技术《攻防技战术动态一周更新 – 20251215》