DLHell is a tool for performing local and remote DCOM Windows DLL proxying. It can intercept DLLs on remote objects to execute arbitrary commands. The tool supports various authentication methods and provides capabilities for local and remote DLL proxying, as well as DCOM DLL proxying.

This week, we are joined by Hosein Yavarzadeh from the University of California San Diego, as he is discussing his work on "Pathfinder: High-Resolution Control-Flow Attacks Exploiting the Conditional Branch Predictor" This paper introduces new methods that let attackers read from and write to specific parts of high-performance CPUs, such as the path history register (PHR) and prediction history tables (PHTs).

∆ Simple EDR In Nim

∆ EDR IS BY NO MEANS THE FINAL SOLUTION [ Blog ]

∆ A brief analysis of EDR architecture - taking Windows platform as an example [ Blog ]

∆ Summary of all EDR bypass methods found so far [ blog ]

⎗ Notes On Process in windows

Twitter : @zer1t0
⊞ Attacking Active Directory: 0 to 0.9

LinkedIn: Sean Metcalf
His Blog:
⊞ https://adsecurity.org/
His Compony:
⊞ https://www.trimarcsecurity.com/research