Read teaming
field-notes-on-malware

rise-of-read-teaming

[ Living Off the Land: Windows Post-Exploitation Without Tools ]

Blog about post-exploitation using only built-in, signed Microsoft tools (PowerShell, WMI, certutil, bitsadmin, and more), without uploading any custom binaries or dropping suspicious artifacts.

https://xbz0n.sh/blog/living-off-the-land-windows

(note from admin: don't forget that PS/WMIC and other things that are described in this article will also be detected)

K7 Antivirus: Named pipe abuse, registry manipulation and privilege escalation

https://blog.quarkslab.com/k7-antivirus-named-pipe-abuse-registry-manipulation-and-privilege-escalation.html

#CVE-2024-36424

Red Team OPSEC Failures: Lessons from Real Operations and Case Studies

#redteam #opsec

How Poor Asset Management Turns Enterprise Attack Surfaces Exploitable

#redteam #tip

APT34 (OilRig): Iran’s Adaptive Cyber Espionage Arm from 2014–2025

#IRAN #APT

Trainsec - MAoS – Malware Analysis on Steroids Bundle

🔗 Download

Info : https://trainsec.net/courses/maos-malware-analysis-on-steroids-bundle/

@offenciveSec

CLR Unhooking Tool

Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing manual mappers on GitHub and integrate one into your codebase. I’m not including one here, as AV vendors generally don’t appreciate that

A native C++ utility that bypasses EDR/AV hooks in the .NET Common Language Runtime by restoring the original nLoadImage function implementation.

Matthew Graeber (@mattifestation) - Reverse engineering InternalCall methods and CLR internals


#clr #bypass #rev

LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems (HIPS) through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed modules—completely fooling behavioral analysis engines that rely on call stack inspection and module origin verification.

Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks
Uses hardware breakpoints + VEH to hijack legitimate functions and spoof module origins

│ 1. Target Function Call
│ ↓
│ 2. CPU Debug Register Triggers (DR0-DR3) │
│ ↓
│ 3. EXCEPTION_SINGLE_STEP Raised │
│ ↓
│ 4. VEH Handler Intercepts Exception │
│ ↓
│ 5. Execution Redirected to Hook Function │
│ ↓
│ 6. CallOriginal() Temporarily Disables Breakpoint
│ ↓
│ 7. Original Function Executes │
│ ↓
│ 8. Breakpoint Re-enabled

#callstackspoofing #edr

APT15 Cyber Espionage: Campaigns and TTPs Analysis

My favorite Group 😁

#ttp #china

Malware Just Got Its Free Passes Back!

#callstack #edr

Prince of Persia: A Decade of Iranian Nation-State APT Campaign Activity under the Microscope

See how a SafeBreach researcher tracked the malicious threat actor to achieve unprecedented visibility into the group’s ongoing operations, including activity as recently as December 2025.