Ikalogic ikalogic.com

Alternative to Saleae logic analyzers :euro:.

AutorunsToWinEventLog.ps1 github.com

Instead of using CSV output and copy these file to the server, you can use the AutorunsToWinEventLog script to convert the Autoruns output to Windows event logs and rely on standard Windows event log forwarding.

ENISA: Recommendations for a methodology of the assessment of severity of personal data breaches enisa.europa.eu

Analysis of embedded applications by evolutionary fuzzing ieeexplore.ieee.org

Data Pseudonymisation: Advanced Techniques and Use Cases enisa.europa.eu

PowerShell implementation of Autoruns github.com

Another way to find Windows persistence locations is to look at the source code of the PowerShell version of Autoruns. Bonus: A history of the covered persistence locations for each Autoruns version is found at the end of the module file too, which is so awesome!

Challenges in Designing Exploit Mitigations for Deeply Embedded Systems ieeexplore.ieee.org

HydraNFC hydrabus.com

Powerful 13.56MHz RFID / NFC platform. Read / write / crack / sniff / emulate.

Website Evidence Collector (WEC) edps.europa.eu

HydraBus hydrabus.com

Open source multi-tool hardware similar to the BusPirate but with NFC capabilities.

Factsheets edps.europa.eu

Hardwear.io hardwear.io

European Data Protection Supervisor edps.europa.eu

Guidelines edpb.europa.eu

Hacking Printers Wiki hacking-printers.net

All things printer.

European Data Protection Board edpb.europa.eu

Guidelines on Data Protection Impact Assessment (WP29) ec.europa.eu

YardStick One greatscottgadgets.com

Half-duplex sub-1 GHz wireless transceiver.

Data Protection Laws of the world dlapiperdataprotection.com

Norwegian DPA - Software development with Data Protection by Design and by Default datatilsynet.no

CyLab Usable Privacy and Security Laboratory cups.cs.cmu.edu

UberTooth One greatscottgadgets.com

Open source 2.4 GHz wireless development platform suitable for Bluetooth experimentation.

CISPE Code of Conduct codeofconduct.cloud

KnockKnock github.com

A persistence detection tool for macOS to scan for persistence mechanisms on macOS. Specific persistence locations are found in the plugins folder, e.g. LaunchItems or StartupScripts.

Open-source DPIA software from the French DPA cnil.fr

JTAGULATOR grandideastudio.com

Detects JTAG Pinouts fast.

Sigma rules github.com

Repository of detection rules, covering persistence techniques as well. You can even use filters such as --filter tag=attack.persistence or specifically for one technique tag=attack.t1084.

GracefulSecurity - Hardware tag gracefulsecurity.com

Data protection around the world cnil.fr

IoTSecFuzz gitlab.com

Framework for automatisation of IoT layers security analysis: hardware, software and communication.

EXPLIoT gitlab.com

Pentest framework like Metasploit but specialized for IoT.

The Hacker's Hardware Toolkit: The best collection of hardware gadgets for Red Team hackers, Pentesters and security… github.com

OWASP Cheat Sheet Series cheatsheetseries.owasp.org

PoisonApple github.com

Learn about various macOS persistence techniques by looking at the source code of PoisonApple.

PANIX - Persistence Against *NIX - Features github.com

List of persistence techniques.

COM Object hijacking: the discreet way of persistence, 2014 gdatasoftware.com

Abusing COM hijacking in combination with scheduled tasks, 2016 enigma0x3.net

Linux Detection Engineering - A primer on persistence mechanisms elastic.co

List of Linux persistence mechanisms.

Hardware Hacking 101 github.com

Workshop @ BSides Munich 2019.

RegDelNull docs.microsoft.com

Removal of registry keys with null bytes - used e.g. in run keys for evasion.

Autoruns docs.microsoft.com

You can learn which Windows persistence mechanisms are checked by looking at the output of Autoruns on your own client. Categories and the different locations where things were found are seen in the output. A disassembly of Autoruns lists a subset of the entries which are…

Firmware Mod Kit github.com

Extraction tools for several container formats.

Persisting on Entra ID applications and User Managed Identities with Federated Credentials dirkjanm.io

Persist on Entra ID applications and User Managed Identities with Federated Credentials.

Borrowing Windows Hello keys for authentication and persistence dirkjanm.io

Ability to perform single-sign on with the backing cryptographic Windows Hello keys from a user session, without needing the PIN or other information/user presence.

Uncovering a MyKings Variant With Bootloader Persistence via Managed Detection and Response blog.trendmicro.com

Blog post about bootloader persistence.

Untangling Kovter's persistence methods blog.malwarebytes.com

Blog post about Kovter's persistens methos, among others, hiding in registry. Another one is Threat Spotlight: Kovter Malware Fileless Persistence Mechanism.

MITRE ATT&CK tactic "TA0003 - Persistence" attack.mitre.org

Persistence tactic information in the MITRE ATT&CK framework.

Malware persistence techniques andreafortuna.org

Good summary of multiple persistence mechanisms, ranging from multiple registry keys to more advanced one, like COM hijacking.

Freakduino freaklabsstore.com

Low Cost Battery Operated Wireless Arduino Board that can be turned into a IEEE 802.15.4 protocol sniffer.

PWN Xerox Printers (...again) fkie.fraunhofer.de