b401

// https://security.microsoft.com/apiproxy/mtp/huntingService/queries/encode

Advanced hunting encodes the query for sharing purposes.

1. \x00 gets added to every second position in the query (DeviceEvents => D\x00e\x00v\x00...)
2. Query gets gzip compressed
3. Compressed query gets base64 encoded with a limited character set.
4. Position 5 - 13 gets replaced with 'A'

You can now send the encoded query through https://security.microsoft.com/v2/advanced-hunting?query={add query here}&timeRangeId=week

dxflatline

Slightly different version from tyranidlair, other functions used from NtObjectManager

Uninstall-Module NtObjectManager
Install-Module -Name NtObjectManager

Stop-Service TrustedInstaller
Start-Service TrustedInstaller
$tipid = get-process TrustedInstaller | select -expand id
$token = Get-NtTokenFromProcess -ProcessId $tipid
$current = Get-NtThread -Current -PseudoHandle

Blevene

09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa
149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff
190d9c3e071a38cb26211bfffeb6c4bb88bd74c6bf99db9bb1f084c6a7e1df4e
24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982
593bbcc8f34047da9960b8456094c0eaf69caaf16f1626b813484207df8bd8af
5ad4efd90dcde01d26cc6f32f7ce3ce0b4d4951d4b94a19aa097341aff2acaec
7c465ea7bcccf4f94147add808f24629644be11c0ba4823f16e8c19e0090f0ff
9b60c622546dc45cca64df935b71c26dcf4886d6fa811944dbc4e23db9335640

jaredcatkinson

function Get-InjectedThread
{
    <# 
    
    .SYNOPSIS 
    
    Looks for threads that were created as a result of code injection.
    
    .DESCRIPTION