RT @binaryz0ne: Our @cyber5w's next month #DFIR webinar will be about Windows Scheduled Tasks and GhostTask Investigations. #DFIR #Cybersec….

RT @jsecurity101: We have all heard about attackers leveraging firewall policies or WFP to block EDRs from communicating with their servers….

Blazing-fast image creation – using just your voice. Try Grok Imagine.

Something interesting I found in SCCM remote control.

RT @0x64616e: Binding to port 445 on Windows without WinDivert. This is highly useful for NTLM relaying. Big thanks to @zyn3rgy for the tal….

RT @ommadawn46: “Windows Kernel Exploitation — HEVD on Windows 10 22H2” by ommadawn46.

RT @NinjaParanoid: Finally, the last release for this year - Brute Ratel v1.8 codename Mirage is here. Various internal updates for evasion….

RT @h4wkst3r: Today I am releasing a whitepaper and new tool (ADOKit) as part of my @XForce research I will be presenting at @BlackHatEvent….

My key reference.

Made a tool to create/modify schedule task using just registry keys. It has some requirements (require SYSTEM) but the beauty of it is it wont generate schedule task creation event log.

RT @BleepinComputer: Microsoft Excel now blocking untrusted XLL add-ins by default - @serghei.

RT @KlezVirus: [RELEASE] After a little wait, I'm happy to present SilentMoonwalk, a PoC implementation of a TRUE call stack spoofer, resul….

Having some fun to re-implement indirect syscall in C#.

RT @bmcder02: Recently I got asked to do an overview on ETW. I tried to cover everything useful for #DFIR, including multiple ways to captu….

RT @Cneelis: It's #BOFFriday so time for a new @OutflankNL C2-Tool-Collection update:.> Psx - Show detailed process information incl. OPSEC….

RT @DebugPrivilege: I've wrote an article a few months ago about Kerberoasting with OpSec and I came across someone's work who wrote a tool….

RT @Un4v5s8bgsVk9Xp: とりあえずあと4話。

RT @tiraniddo: I said I'd write up how you could exploit RBCD using a normal user account if you know the password. So here it is https://t….

Exploit CVE-2022–26923 -> DCSync as domain controller -> Bypass most of the 4662 event based DCSync detection🤔.

RT @ly4k_: The first blog post is here. This one covers the technical details of CVE-2022-26923 (Active Directory Domain Services Elevation….

RT @rootsecdev: Have fun everyone. Certifried: Active Directory Domain Privilege Escalation (CVE-2022–26923).