Tuesday, August 9, 2022
HomeHackerDevice Aimed To Assist Purple Teamers To Keep Hidden By Clearing Proof...

Device Aimed To Assist Purple Teamers To Keep Hidden By Clearing Proof Of Execution




MrKaplan is a software aimed to assist crimson teamers to remain hidden by clearing proof of execution. It really works by saving data such because the time it ran, snapshot of information and affiliate every proof to the associated consumer.

This software is impressed by MoonWalk, an analogous software for Unix machines.

You possibly can learn extra about it within the wiki web page.

Options

Utilization

  • Earlier than you begin your operations on the pc, run MrKaplan with start flag and at any time when your end run it once more with finish flag.
  • DO NOT REMOVE MrKaplan registry key, in any other case MrKaplan won’t be able to make use of the knowledge.

IOCs

  • Powershell course of that entry to the artifacts talked about within the wiki web page.

  • Powershell importing bizarre base64 blob.

  • Powershell course of that performs Token Manipulation.

  • MrKaplan’s registry key: HKCU:SoftwareMrKaplan.

Acknowledgements

Disclaimer

I am not accountable in any method for any form of harm that’s finished to your pc / program as explanation for this challenge. I am fortunately settle for contribution, make a pull request and I’ll overview it!



RELATED ARTICLES

LEAVE A REPLY

Please enter your comment!
Please enter your name here

- Advertisment -
Google search engine

Most Popular

Recent Comments