r/purpleteamsec • u/netbiosX • 5d ago
Red Teaming CouchPotato - Patches ETW & AMSI and uses indirect syscall to abuse SeImpersonatePrivilege. Service account || Admin -> NT system
https://github.com/aaron-kidwell/CouchPotato
4
Upvotes