Introduction Quick post about Windows System calls that I forgot about working on after the release of Dumpert by Cn33liz last year, which is described in this post. Typically, EDR and AV set hooks…

This is a kind of follow-up to my last post, in which I discussed a technique that can be used for elevating privileges to SYSTEM when you have impersonation capabilities. In the last part, I explained how this type of vulnerability could be fixed and I even…

A small proof of concept Windows shellcode injector using syscalls.

Microsoft .NET framework is being heavily utilized by threat actors and red teams for defense evasion and staying off the radar during operations. Every .NET binary contains application domains whe…

Introduction In-memory tradecraft is becoming more and more important for remaining undetected during a red team operation, with it becoming common practice for blue teams to peek in to running...

Introduction

NINA: No Injection, No Allocation x64 Process Injection Technique.

When CompatTelRunner.exe runs (current version as of May 2020), it first checks that a few conditions pass before continuing its telemetry quest. After…

This blog –part of a year-long research project that uncovered 60 different vulnerabilities across major vendors – discusses a vulnerability in the Windows group policy object (GPO) mechanism....

A look at code to parse the PE header and remove API hooks placed by AV/EDR.

Introduction Heresy's Gate Closing Nebbett's Gate Meltdown KVA Shadow Page Fault Loop NTDLL ...

Abusing a bug in Sysmon's driver to fake source processes' image file names.

During a red team engagement, one of the first things you may want to do after obtaining initial access is establish reliable persistence on the endpoint. Being able to streamline...

A dive into Windows DLLs, DLL hijacking, automation, WinAPI, and finding the root cause of shared DLL hijacks.

Research by: Sagi Tzadik Introduction DNS, which is often described as the “phonebook of the internet”, is a network protocol for translating human-friendly computer hostnames into IP addresses. Because it is such a core component of the internet, there are…

Starting with Windows 8.1 (and Server 2012 R2) Microsoft introduced a feature termed LSA Protection. This feature is based on the ...

A few weeks ago, I was going over some of the research topics in my to-do list, and the one that sounded interesting to work on during 4th…

Enumerate and disable common sources of telemetry used by AV/EDR. - jthuraisamy/TelemetrySourcerer