Spent the weekend working on Cyllex and added a Splunk integration for log correlation. Also added detection events for each TTP. There's still a lot of work ahead, but it's starting to look great! I'll keep working on more integrations.
Thanks to everyone who's been showing interest and supporting the project! :)
Spent the weekend working on Cyllex:
→ Interactive onboarding tour
→ AWS TTPs (57% MITRE coverage)
→ Linux TTPs (22% MITRE coverage)
→ Windows TTPs: ADCS & ShadowCreds
→ LDAP Enum TTPs with multiple maturity levels
→ Reporting improvements
→ Improved agent deployment with guided instructions
Next: 100% focused on TTP coverage
cyllex.io/blog/updates.html
Reusing part of the ESC1-unPAC BOF code to create a ShadowCreds + unPAC BOF
1. Write msDS-KeyCredentialLink attribute using obfuscated LDAP queries.
2. Authenticate to the KDC using PKINIT.
3. unPAC-the-hash.
4. Cleanup msDS-KeyCredentialLink.
github.com/RayRRT/BOFs/tree/…
One-shot ESC1 + unPAC BOF for Havoc and CS. The certificate request includes the target's SID in the SAN to comply with strong mapping requirements (KB5014754). Hope it’s useful github.com/RayRRT/ESC1-unPAC