PR #1764: COM hijacking

First-time contributor  KelseySeymour created a test for T1546.015: Component Object Model Hijacking. The test uses PowerShell to hijack a reference to a Component Object Model (COM) that can be ultimately executed with rundll32.exe.

So, you want to build a community in infosec?

Two of our Atomic Red Team members, Adam Mashinchi and Marrelle Bailey, joined other community managers who shared their insights on how to build, maintain, and support various collaborative projects in the infosec world. If you missed the panel discussion you can watch the recording! 

Intelligence Insight

The February 2022 edition of Red Canary's Intelligence Insights documents the re-emergence of Emotet—a threat that warrants concern over its connection to ransomware in the past. While Emotet’s initial access tradecraft varies, the threat reliably leverages encoded PowerShell commands. You can test your ability to observe and detect this behavior with two of our PowerShell Atomic Test Harnesses (17 and 18).

Atomic Red Team maintainers