Folder Path

/vx/Papers/Windows/

0 directories 669 files
List Grid
Name
Size Modified
Up
2004-04-06 - Remote Library Injection.pdf
248 KiB
2005-05-30 - Making WMI Queries In C.7z
293 KiB
2006-05-22 - Windows Network Services Internals.pdf
1.7 MiB
2008-12-27 - Detailed Guide to PE Infection.txt
9.7 KiB
2009-05-03 - PE Infection - How to Inject a DLL.pdf
707 KiB
2010-01-12 - Exercising the Firewall using Cplusplus.pdf
97 KiB
2011-01-25 - No Loitering - Exploiting Lingering Vulnerabilities in Default COM Objects.pdf
325 KiB
2011-05-04 - The Ultimate Anti-Debugging Reference.pdf
723 KiB
2011-06-29 - Implementing keyloggers in Windows.pdf
602 KiB
2012-02-14 - Stack Necromancy - Defeating Debuggers By Raising the Dead.pdf
179 KiB
2012-03-21 - Using UPX as a Security Packer.pdf
1.9 MiB
2012-09-19 - Knockin on Heavens Gate - Dynamic Processor Mode Switching.pdf
476 KiB
2012-11-01 - SizeOfStackReserve As Anti-Attaching Trick.pdf
538 KiB
2014-02-03 - PE Injection Demonstration 1.zip
4.4 KiB
2014-02-06 - Hide process with DKOM without hard coded offsets.txt
5.2 KiB
2014-04-13 - PE Injection Explained Advanced memory code injection technique.pdf
310 KiB
2014-12-03 - Hooking COM Objects - Intercepting Calls to COM Interfaces.7z
386 KiB
2015-03-06 - PE Infection - Add a PE section - with code.txt
5.1 KiB
2015-03-30 - Another detailed guide to PE infection.txt
17 KiB
2015-04-06 - Hiding loaded driver with DKOM.txt
2.3 KiB
2015-08-10 - Windows 10HH Symbolic Link Mitigations.pdf
387 KiB
2015-08-12 - Stealth Techniques - Hiding Files in the Registry.pdf
351 KiB
2015-08-20 - Manually Enumerating Process Modules.pdf
222 KiB
2015-12-05 - Abusing WMI To Build A Persistent Asynchronous And Fileless Backdoor.pdf
994 KiB
2016-01-12 - Creating Processes By Using Undocumented COM APIs.7z
1.0 KiB
2016-02-10 - The Definitive Guide on Win32 to NT Path Conversion.pdf
935 KiB
2016-05-19 - PE File Infection.pdf
230 KiB
2016-10-27 - AtomBombing - A Brand New Code Injection Technique for Windows.pdf
214 KiB
2016-11-21 - Keylogging using ETW in CSharp.NET.7z
3.3 MiB
2017-06-07 - Process Hollowing with Manalyzes PE library.pdf
386 KiB
2017-08-12 - Finding handle leaks - user mode duplicate handle in C and CSharp.zip
47 KiB
2017-09-19 - Abusing Delay Load DLLs for Remote Code Injection.pdf
208 KiB
2017-10-03 - Windows 10 Parallel Loading Breakdown.pdf
2.1 MiB
2017-10-06 - An Introduction to Standard and Isolation Minifilters.pdf
338 KiB
2017-10-15 - Understanding API Set Resolution.7z
558 KiB
2018-03-17 - Abusing Exported Functions and Exposed DCOM Interfaces.pdf
890 KiB
2018-03-26 - Ghostwrite Demonstration.c
50 KiB
2018-06-14 - PE Injection Demonstration 2.zip
3.3 KiB
2018-06-18 - Exploring PowerShell AMSI and Logging Evasion.pdf
1.6 MiB
2018-08-07 - Windows Exploitation Tricks Exploiting Arbitrary Object Directory Creation for Local Elevation of Pri.pdf
255 KiB
2018-08-19 - NTFS Alternate Streams What, When, and How To.7z
236 KiB
2018-09-06 - Persistence using Universal Windows Platform apps.pdf
379 KiB
2018-09-09 - Finding Interactive User COM Objects using PowerShell.pdf
129 KiB
2018-10-16 - Injecting Code into Windows Protected Processes using COM - Part 1.pdf
1.2 MiB
2018-10-20 - Using DropBox As A C2.zip
443 KiB
2018-11-01 - Process Injection Techniques and Detection using the Volatility Framework.pdf
5.6 MiB
2018-11-30 - Injecting Code into Windows Protected Processes using COM - Part 2.pdf
690 KiB
2018-12-12 - VBA RunPE - Breaking Out of Highly Constrained Desktop Environments.7z
298 KiB
2019-01-04 - A dive into the world of MS-DOS viruses.pdf
1.7 MiB
2019-02-15 - Understanding Windows x64 ASM.7z
2.0 MiB
2019-02-25 - Notes on RtlCloneUserProcess.7z
436 KiB
2019-04-07 - Loading and calling VB from CPlusPlus.zip
5.3 KiB
2019-04-08 - Early Bird Injection - APC Abuse.pdf
892 KiB
2019-04-26 - Hunting for Ghosts in Fileless Attacks.pdf
4.3 MiB
2019-06-03 - How Red Teams Bypass AMSI and WLDP for .NET Dynamic Code.pdf
317 KiB
2019-06-19 - Combining Direct System Calls and sRDI.pdf
2.0 MiB
2019-06-29 - Persistence with Windows Services.pdf
123 KiB
2019-07-03 - Dumping LSASS - MiniDumpWriteDump to Disk.txt
1.2 KiB
2019-07-03 - MiniDumpWriteDump and PssCaptureSnapshot.txt
2.3 KiB
2019-07-07 - Calling Syscalls Directly from Visual Studio to Bypass AVs and EDRs.pdf
503 KiB
2019-07-07 - Dumping LSASS - MiniDumpWriteDump to Memory using MiniDump Callbacks.txt
3.4 KiB
2019-07-21 - In-memory execution of VBScript, JavaScript or JScript.txt
7.2 KiB
2019-08-08 - Demonstating Various Process Injection Techniques - Pinjecta.zip
98 KiB
2019-08-08 - Process Injection Techniques - Gotta Catch Them All.pdf
734 KiB
2019-08-12 - Windows Process Injection via KnownDlls Cache Poisoning.pdf
355 KiB
2019-08-13 - The state of advanced code injections.pdf
462 KiB
2019-08-16 - IBM Java Control Panel for persistence.pdf
86 KiB
2019-08-17 - Weaponizing Privileged File Writes with the USO Service.7z
1.1 MiB
2019-08-22 - Common Language Runtime Hook for Persistence.pdf
2.6 MiB
2019-08-23 - How the Antimalware Scan Interface AMSI helps you defend against malware.pdf
430 KiB
2019-09-07 - AutoPlay Handlers for persistence.pdf
101 KiB
2019-09-20 - Exotic persistence - Windows Error Reporting Debugger key.pdf
60 KiB
2019-10-11 - An alternate way to execute a binary - NtQueryInformationProcess and the AeDebugProtected key.pdf
123 KiB
2019-10-23 - SPReview Phantom DLLs.pdf
64 KiB
2019-10-24 - SPReview Permanent Persistence.pdf
67 KiB
2019-11-06 - Bypassing Kernel Function Pointer Integrity Checks.pdf
207 KiB
2019-11-11 - Antimalware Scan Interface AMSI.pdf
76 KiB
2019-11-18 - Abusing Intel VTune Amplifier for Persistence.pdf
66 KiB
2019-12-02 - Evading WinDefender ATP credential-theft a hit after a hit-and-miss start.pdf
464 KiB
2019-12-17 - Calling Local Windows RPC Servers from NET.pdf
431 KiB
2020-01-02 - Exploiting Flaws in Windbg.pdf
1012 KiB
2020-01-05 - RIP ROP CET Internals in Windows 20H1.pdf
1.6 MiB
2020-01-06 - NtCreateSection and NtMapViewOfSection for Code Injection.pdf
687 KiB
2020-01-23 - Starting WERSVR from a restricted users.7z
491 KiB
2020-01-31 - DKOM - Now with Symbolic Links.pdf
688 KiB
2020-02-03 - Bypass EDRs memory protection - an introduction to hooking.pdf
1.3 MiB
2020-02-03 - Hooking Heavens Gate - a WOW64 hooking technique.pdf
566 KiB
2020-02-10 - From Process Injection to Function Hijacking.pdf
440 KiB
2020-02-10 - WDExtract - Extracting data from Windows Defender.zip
369 KiB
2020-02-18 - Move aside signature scanning Better kernel data discovery through lookaside lists.pdf
414 KiB
2020-02-18 - Symbolic Hooks Part 2 Getting the Target Name.pdf
565 KiB
2020-02-23 - A stealthier approach to spoofing process command line.pdf
278 KiB
2020-02-29 - Windows Kernel Ps Callbacks Experiments.pdf
2.6 MiB
2020-03-18 - ShimBad the Sailor.pdf
95 KiB
2020-03-19 - Symbolic Hooks Part 3 The Remainder Theorem.pdf
166 KiB
2020-03-24 - Symbolic Hooks Part 4 The App Container Traverse-ty.pdf
1.0 MiB
2020-04-01 - Updating the Undocumented ESTROBJ and STROBJ Structures for Windows 10 x64.pdf
827 KiB
2020-04-24 - Windows DLL Hijacking Hopefully Clarified.pdf
737 KiB
2020-04-30 - Fax Shell - Using Fax service for system.7z
13 KiB
2020-04-30 - Faxing Your Way to SYSTEM Part Two.pdf
1.5 MiB
2020-05-03 - Fax Service Bind shell abusing Ualapi.7z
13 KiB
2020-05-10 - The Fake Entry Point Trick.txt
4.2 KiB
2020-05-12 - PrintDemon Print Spooler Privilege Escalation Persistence amp Stealth CVE-2020-1048 amp more.pdf
1.2 MiB
2020-05-17 - APC Series User APC API.pdf
337 KiB
2020-05-18 - How to use Trend Micro's Rootkit Remover to Install a Rootkit.pdf
719 KiB
2020-05-27 - Shellcode - Recycling Compression Algorithms for the Z80, 8088, 6502, 8086 and 68K Architectures.pdf
414 KiB
2020-05-28 - GetEnvironmentVariable As Alternative to WriteProccessMemory in Process Injections.pdf
137 KiB
2020-06-01 - Using Syscalls to Inject Shellcode on Windows.pdf
1.0 MiB
2020-06-03 - APC Series User APC Internals.pdf
599 KiB
2020-06-06 - NINA - x64 Process Injection.pdf
980 KiB
2020-06-09 - Abusing Windows Telemetry for Persistence.pdf
196 KiB
2020-06-10 - Cmd Hijack - A Command_Argument Confustion with Path Traversal.pdf
2.2 MiB
2020-06-14 - Process Injection Techniques.pdf
629 KiB
2020-06-20 - Hiding Process Memory via Anti-Forensic Techniques.pdf
467 KiB
2020-06-24 - Process Injection Techniques used by Malware.pdf
207 KiB
2020-06-28 - APC Series KiUserApcDispatcher and Wow64.pdf
335 KiB
2020-07-03 - How to obfuscate strings using CPlusPlus constexpr Or how to do it correctly at compile time.txt
7.7 KiB
2020-07-10 - Fs Minifilter Hooking Part 1.pdf
1.5 MiB
2020-07-10 - Masking Malicious Memory Artifacts Part 1 – Phantom DLL Hollowing.pdf
599 KiB
2020-07-11 - Superfetch - Unknown Spy.pdf
1.5 MiB
2020-07-12 - Secure Pool Internals Dynamic KDP Behind The Hood.pdf
1.3 MiB
2020-07-16 - Masking Malicious Memory Artifacts Part II - Blending in with False Positives.pdf
6.6 MiB
2020-07-16 - Weaponizing Mapping Injection With instrumentation Callback.pdf
709 KiB
2020-07-30 - Terminal Server Utilities LOLBIN and Persistence.pdf
100 KiB
2020-08-02 - Removing Kernel Callbacks Using Signed Drivers.7z
422 KiB
2020-08-03 - Critical Protected DUT Processes in Windows 10.pdf
474 KiB
2020-08-04 - Masking Malicious Memory Artifacts Part III - Bypassing Defensive Scanners.pdf
3.7 MiB
2020-08-05 - Checkpoint Research - Anti-Debug - Assembly instructions.pdf
334 KiB
2020-08-05 - Checkpoint Research - Anti-Debug - Debug Flags.pdf
743 KiB
2020-08-05 - Checkpoint Research - Anti-Debug - Direct debugger interaction.pdf
425 KiB
2020-08-05 - Checkpoint Research - Anti-Debug - Exceptions.pdf
207 KiB
2020-08-05 - Checkpoint Research - Anti-Debug - Misc.pdf
349 KiB
2020-08-05 - Checkpoint Research - Anti-Debug - Object Handles.pdf
309 KiB
2020-08-05 - Checkpoint Research - Anti-Debug - Process Memory.pdf
660 KiB
2020-08-05 - Checkpoint Research - Anti-Debug - Timing.pdf
266 KiB
2020-08-16 - QT Framework QT_DEBUG_PLUGINS Persistence.pdf
62 KiB
2020-09-16 - Defeating Macro Document Static Analysis with Pictures of My Cat.pdf
917 KiB
2020-09-16 - Silent Runners - Exploring Persistence Methods.7z
100 KiB
2020-09-18 - Covert Data Persistence with Windows Registry Keys.pdf
111 KiB
2020-09-18 - More Windows 10 Phantom DLLs.pdf
65 KiB
2020-09-26 - Deep dive into user-mode Asynchronous Procedure Calls in Windows.pdf
717 KiB
2020-09-26 - Demystifying the SVCHOSTEXE Process and Its Command Line Options.pdf
350 KiB
2020-10-02 - Malware Persistence Mechanisms.pdf
856 KiB
2020-10-06 - CET Updates - CET on Xanax.pdf
247 KiB
2020-10-08 - Cryogenically Frozen Malware.7z
316 KiB
2020-10-10 - A Deep Dive Into RUNDLL32EXE.pdf
279 KiB
2020-10-11 - From a C project through assembly to shellcode.pdf
1.3 MiB
2020-10-11 - Masquerading the HKCU Run Key.7z
138 KiB
2020-10-12 - I Like to Move It - Windows Lateral Movement Part 3 - DLL Hijacking.pdf
2.0 MiB
2020-10-17 - DllBidEntryPoint Abuse.pdf
68 KiB
2020-10-18 - Commandeering Context Menu Entries.7z
525 KiB
2020-10-19 - SERVICE_FAILURE_ACTIONSW Exception for Persistence.pdf
63 KiB
2020-11-09 - DPWs are the new DPCs Deferred Procedure Waits in Windows 10 21H1.pdf
1.1 MiB
2020-11-09 - WOW64Hooks WOW64 Subsystem Internals and Hooking Techniques.pdf
1012 KiB
2020-11-21 - Exploiting a Simple Vulnerability In 35 Easy Steps or Less.pdf
2.2 MiB
2020-11-23 - A Fresh Outlook on Mail Based Persistence.pdf
296 KiB
2020-11-29 - Weaponize GhostWriting Injection Code Injection Series Part 5.pdf
381 KiB
2020-12-24 - The worst of the two worlds - Excel meets Outlook.pdf
242 KiB
2020-12-31 - Antivirus Artifacts III.pdf
344 KiB
2020-12-31 - Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams.pdf
332 KiB
2021-01-08 - Exploiting a Simple Vulnerability Part 15 The Info Leak.pdf
464 KiB
2021-01-09 - CET Updates - Dynamic Address Ranges.pdf
198 KiB
2021-01-09 - Heresys Gate Kernel ZwNTDLL Scraping and Work Out Ring 0 to Ring 3 via Worker Factories.pdf
442 KiB
2021-01-10 - Offensive Windows IPC Internals 1 Named Pipes.pdf
579 KiB
2021-01-12 - tagSOleTlsData and the COM concurrency model for the current thread.pdf
618 KiB
2021-01-20 - Process on a diet anti-debug using job objects.pdf
93 KiB
2021-01-24 - LSASS Memory Dumps are Stealthier than Ever Before - Part 1.pdf
477 KiB
2021-01-30 - Executing Position Independent Shellcode from Object Files in Memory.pdf
905 KiB
2021-02-06 - Microsoft Office HTML Editor for Persistence.pdf
116 KiB
2021-02-12 - Offensive Windows IPC Internals 2 RPC.pdf
682 KiB
2021-02-13 - x64 Deep Dive.pdf
923 KiB
2021-02-16 - LSASS Memory Dumps are Stealthier than Ever Before - Part 2.pdf
268 KiB
2021-02-27 - Windows object permissions as a backdoor.pdf
810 KiB
2021-02-28 - PE Injection_ Executing PEs inside Remote Processes.pdf
683 KiB
2021-03-01 - Shellcode Execution via CopyFile2.cpp
1.9 KiB
2021-03-01 - Shellcode Execution via CreateTimerQueueTimer.cpp
1.8 KiB
2021-03-01 - Shellcode Execution via CreateTimerQueueTimer_Tech.cpp
1.7 KiB
2021-03-01 - Shellcode Execution via EnumChildWindows.cpp
1.5 KiB
2021-03-01 - Shellcode Execution via EnumResourceTypesW.cpp
1.6 KiB
2021-03-01 - Shellcode Execution via EnumWindows.cpp
1.5 KiB
2021-03-02 - Shellcode Execution via EnumDisplayMonitors.cpp
1.5 KiB
2021-03-02 - Shellcode Execution via EnumPropsEx.cpp
1.6 KiB
2021-03-03 - Shellcode Execution via EnumDesktopWindows.cpp
1.6 KiB
2021-03-05 - Persistence via Java Environment Variables.pdf
83 KiB
2021-03-05 - Shellcode Execution via EnumPageFilesW.cpp
1.4 KiB
2021-03-07 - Shellcode Execution via CopyFileEx.cpp
1.6 KiB
2021-03-07 - Shellcode Execution via EnumWindowStationsW.cpp
1.5 KiB
2021-03-07 - Shellcode Execution via SymEnumProcesses.cpp
1.6 KiB
2021-03-08 - Shellcode Execution via EnumerateLoadedModules.cpp
1.5 KiB
2021-03-08 - Shellcode Execution via ImageGetDigestStream.cpp
1.8 KiB
2021-03-10 - Exfiltrating Data from Outlook Demonstration.7z
3.7 KiB
2021-03-11 - Exploiting a Simple Vulnerability Part 2 What If We Made Exploitation Harder.pdf
997 KiB
2021-03-11 - Shellcode Execution via VerifierEnumerateResource.cpp
2.1 KiB
2021-03-12 - Shellcode Execution via CertEnumSystemStore.cpp
1.5 KiB
2021-03-14 - Shellcode Execution via CertEnumSystemStoreLocation.cpp
1.5 KiB
2021-03-18 - Anti Debugging Protection Techniques with Examples.pdf
1.0 MiB
2021-03-19 - Shellcode Execution via CreateThreadPoolWait.cpp
2.0 KiB
2021-03-19 - Shellcode Execution via EnumDesktopW.cpp
1.6 KiB
2021-03-19 - Shellcode Execution via EnumDirTreeW.cpp
1.7 KiB
2021-03-21 - Shellcode Execution via SysEnumSourceFiles.cpp
1.6 KiB
2021-03-24 - Excel Macro Anti-Analysis Techniques.pdf
1.2 MiB
2021-03-25 - Demonstrating Keylogging Using NtUserGetRawInputDataKeylogger.cpp
37 KiB
2021-03-27 - Shellcode Execution via FiberContextEdit.vcxproj
6.9 KiB
2021-03-27 - Shellcode Execution via InitOnceExecuteOnce.cpp
1.6 KiB
2021-03-27 - Shellcode Execution via SymFindFileInPath.cpp
1.9 KiB
2021-03-28 - Executing a PE File in Memory.zip
19 MiB
2021-03-28 - Shellcode Execution via EnumPropsW.cpp
1.5 KiB
2021-03-28 - Shellcode Execution via FlsAlloc.cpp
1.6 KiB
2021-03-28 - Shellcode Execution via RtlUserFiberStart.vcxproj
6.9 KiB
2021-03-30 - KeDll Injector.rar
17 KiB
2021-03-30 - Shellcode Execution via LdrEnumerateLoadedModules.cpp
3.2 KiB
2021-03-30 - Shellcode Execution via LdrpCallInitRoutine.vcxproj
6.9 KiB
2021-03-31 - Shellcode Execution via EnumLanguageGroupLocalesW.cpp
1.5 KiB
2021-04-01 - Shellcode Execution via SetTimer.cpp
1.6 KiB
2021-04-04 - Shellcode Execution via SetupCommitFileQueueW.cpp
1.7 KiB
2021-04-08 - Process Code Injection Through Undocumented NTAPI.pdf
515 KiB
2021-04-08 - Shellcode Execution via EnumUILanguagesW.cpp
1.5 KiB
2021-04-09 - Shellcode Execution via EnumSystemLocales.cpp
1.5 KiB
2021-04-11 - Shellcode Execution via EnumPwrSchemes.cpp
1.5 KiB
2021-04-12 - Shellcode Execution via EnumResourceTypesExW.cpp
1.6 KiB
2021-04-15 - Shellcode Execution via ImmEnumInputContext.cpp
1.5 KiB
2021-04-20 - Thread and Process State Change.pdf
300 KiB
2021-04-22 - Binary Data Hiding in VB6 Executables.pdf
418 KiB
2021-04-28 - Shellcode Execution via EnumFontsW.cpp
1.5 KiB
2021-04-30 - Shellcode Execution via EnumFontFamiliesW.cpp
1.5 KiB
2021-05-01 - Shellcode Execution via EnumFontFamiliesExW.cpp
1.6 KiB
2021-05-01 - Symantec Endpoint Protection Meets COM - Using Symantec.SSHelper As A LOLBIN.pdf
477 KiB
2021-05-03 - Shellcode Execution via EnumObjects.cpp
1.5 KiB
2021-05-05 - Weird Ways to Run Unmanaged Code in NET.pdf
2.6 MiB
2021-05-06 - Shellcode Execution via CryptEnumOIDInfo.cpp
1.5 KiB
2021-05-07 - Shellcode Execution via EnumTimeFormatsEx.cpp
1.6 KiB
2021-05-12 - Breaking the WDAPT Rules with COM.pdf
2.8 MiB
2021-05-13 - Reshaping Shadow Volumes with IOCTLs.txt
1.5 KiB
2021-05-21 - Dumping Stored Credentials with SeTrustedCredmanAccessPrivilege.pdf
194 KiB
2021-05-23 - Preventing memory inspection on Windows.pdf
164 KiB
2021-05-24 - IO Rings When One IO Operation is Not Enough.pdf
739 KiB
2021-06-12 - Shellcode Execution via EnumICMProfiles.cpp
1.5 KiB
2021-06-18 - Knock Knock The postman is here (abusing Mailslots and PortKnocking for connectionless shells).pdf
457 KiB
2021-06-19 - Backstab - Demonstrating how to kill EDR protected processes.zip
53 KiB
2021-06-20 - Demonstrating How to Dump Chrome Passwords.7z
1003 KiB
2021-06-28 - Stealing Tokens In Kernel Mode With A Malicious Driver.pdf
339 KiB
2021-07-23 - Modifying MS Office security warnings.PNG
45 KiB
2021-07-26 - Shellcoding - Process Injection with Assembly.pdf
1.2 MiB
2021-08-03 - Reading, Writing, and Executing A File WITHOUT A File Path - yarhLoader.c
39 KiB
2021-08-05 - Evil Model - Hiding Malware.pdf
747 KiB
2021-08-23 - Another AMSI-Bypass paper.pdf
1.6 MiB
2021-09-30 - Azure Outlook C2.zip
14 MiB
2021-10-09 - IoRing vs io_uring a comparison of Windows and Linux implementations.pdf
122 KiB
2021-10-09 - Trololololobin and other lolololocoasters.pdf
79 KiB
2021-10-10 - SeManageVolumePrivilege Abuse with FSCTL_SD_GLOBAL_CHANGE.zip
2.2 KiB
2021-10-21 - Life is Pane - Persistence via Preview Handlers.pdf
569 KiB
2021-10-21 - Windows Exploitation Tricks - Relaying DCOM Authentication.pdf
589 KiB
2021-10-23 - From AMSI to Reflection 0x0.pdf
6.1 MiB
2021-10-23 - Shellcode Execution via EnumCalendarInfoEx.cpp
1.5 KiB
2021-10-25 - C3 - Demonstrating C2s from MatterMost - GitHub - OneDrive and more.zip
32 MiB
2021-10-28 - Malicious ZIP Demonstration.zip
15 KiB
2021-11-10 - The DLL Search Order And Hijacking It.pdf
457 KiB
2021-11-15 - Design issues of modern EDRs bypassing ETW-based solutions.pdf
10 MiB
2021-11-18 - Persistence via Recycle Bin.7z
152 KiB
2021-11-26 - Abusing Windows’ Implementation of Fork() for Stealthy Memory Operations.pdf
524 KiB
2021-12-01 - Writing a simple 16 bit VM in less than 125 lines of C.pdf
1.3 MiB
2021-12-05 - Shellcode Execution via EnumThreadWindows.cpp
1.4 KiB
2021-12-07 - Demonstrating USB Propagation.7z
269 KiB
2021-12-07 - Dynamically Retrieving SYSCALLs - Hells Gate.7z
366 KiB
2021-12-07 - Identifying Antivirus Software by enumerating Minifilter String Names.7z
152 KiB
2021-12-07 - Programmatically Modifying Boot Configurations - BCDEdit.7z
6.7 KiB
2021-12-07 - The hidden side of Seclogon part 2 - Abusing leaked handles to dump LSASS memory.pdf
1018 KiB
2021-12-07 - Weaponizing Windows Virtualization.7z
219 KiB
2021-12-09 - Create Microsoft-Signed Phishing Documents.pdf
248 KiB
2021-12-14 - COM Hijacking for Persistence.pdf
760 KiB
2022-01-01 - HyperGuard Secure Kernel Patch Guard Part 1 SKPG Initialization.pdf
1.4 MiB
2022-01-03 - NTSockets - Downloading a file via HTTP using the NtCreateFile.pdf
332 KiB
2022-01-04 - Exploring Token Members Part 1.pdf
680 KiB
2022-01-09 - Understanding Windows Structured Exception Handling Part 1 – The Basics.pdf
350 KiB
2022-01-11 - Signed Kernal Drivers - Unguarded Gateway to Windows Core.pdf
1.4 MiB
2022-01-12 - Playing Around COM Objects Part 1 - DllGetClassObject and ShellExecute IDispatch for Process creation.pdf
2.0 MiB
2022-01-12 - Red Canary - Antimalware Scan Interface (AMSI).pdf
200 KiB
2022-01-15 - CreateRemoteThread Process Injection.7z
5.6 KiB
2022-01-15 - Demonstrating ATOM Bombing.7z
12 KiB
2022-01-15 - Demonstrating EAT hooking from Kernel space.7z
102 KiB
2022-01-15 - Modifying the EPROCESS structure.7z
6.0 KiB
2022-01-15 - Process Doppelgänging POC.7z
129 KiB
2022-01-15 - Process HerpaDerping.7z
301 KiB
2022-01-15 - Programmatically Stopping Windows Defender.7z
158 KiB
2022-01-15 - ReflectiveDLLInjection Example.7z
13 KiB
2022-01-15 - SetThreadContextInjection Example.7z
5.2 KiB
2022-01-15 - SetWindowsHookExInjection Example.7z
3.2 KiB
2022-01-15 - Stealing Process Tokens POC.7z
87 KiB
2022-01-15 - The ExtraWindowInject Process Injection Technique.7z
25 KiB
2022-01-15 - UserApcInject Example.7z
4.7 KiB
2022-01-16 - Notes on Windows MS-CXH and MS-CXH-FULL handlers.pdf
116 KiB
2022-01-16 - Oobe Setup ErrorHandle.cmd Hijack.pdf
70 KiB
2022-01-16 - Understanding Windows Structured Exception Handling Part 2 – Digging Deeper.pdf
260 KiB
2022-01-18 - O365 HKCU WwlibDll Sideloading.pdf
158 KiB
2022-01-22 - Understanding Windows Structured Exception Handling Part 3 – Under The Hood.pdf
468 KiB
2022-01-22 - WinINET InternetErrorDlgEx Registry Lookup persistence.pdf
182 KiB
2022-01-23 - Persistence via P2P_PEER_DIST_API LoadPeerDist.pdf
70 KiB
2022-01-23 - Reload Executable Files to Achieve Efficient Inline-Hook.pdf
120 KiB
2022-01-23 - Understanding Windows Structured Exception Handling Part 4 – Pseudo __try and __except.pdf
167 KiB
2022-01-26 - Using SecureString to protect Malware.pdf
300 KiB
2022-01-28 - The good the bad and the stomped function.7z
720 KiB
2022-01-30 - Retrieving the current EIP in C⁄C++.pdf
96 KiB
2022-01-30 - SetTcpEntry6 - A custom SetTcpEntry implementation for IPv6.pdf
103 KiB
2022-01-31 - Abusing the MS Office protocol scheme.pdf
1.9 MiB
2022-02-01 - System-wide anti-debug technique using NtQuerySystemInformation and DuplicateHandle.pdf
184 KiB
2022-02-02 - Reading and writing remote process data without using ReadProcessMemory ⁄WriteProcessMemory.pdf
154 KiB
2022-02-04 - AppLocker bypass by hash caching misuse.pdf
150 KiB
2022-02-04 - CallRemoteAPI - Call functions in remote processes.pdf
268 KiB
2022-02-04 - CreateSvcRpc - A custom RPC client to execute programs as the SYSTEM user.pdf
345 KiB
2022-02-04 - EmbedExeLnk - Embedding an EXE inside a LNK with automatic execution.pdf
241 KiB
2022-02-04 - JmpNoCall.pdf
1.2 MiB
2022-02-04 - KCTHIJACK - KernelCallbackTable Hijack.zip
2.9 MiB
2022-02-06 - HijackFileHandle - Hijack a file in a remote process without code injection.pdf
230 KiB
2022-02-07 - Invisible Sandbox Evasion - Check Point Research.pdf
216 KiB
2022-02-08 - StackScraper - Capturing sensitive data using real-time stack scanning against a remote.pdf
338 KiB
2022-02-09 - Hooks-On Hoot-Off Vitaminizing MiniDump.pdf
578 KiB
2022-02-10 - WindowsNoExec - Abusing existing instructions to executing arbitrary code without allocating executable memory.pdf
324 KiB
2022-02-14 - Abusing Exceptions for Code Execution Part 1.pdf
210 KiB
2022-02-16 - Exploring Token Members Part 2.pdf
223 KiB
2022-02-16 - wlrmdr.exe LOLBIN.7z
151 KiB
2022-02-17 - HyperGuard Secure Kernel Patch Guard Part 2 SKPG Extents.pdf
858 KiB
2022-02-17 - The magic behind wlrmdrexe.pdf
175 KiB
2022-02-25 - LogNT32 - Part 2 - Return-address hijacking implemented to improve efficiency.pdf
216 KiB
2022-03-11 - AV and EDR Evasion Using Direct System Calls.pdf
1.0 MiB
2022-03-14 - Reversing Common Obfuscation Techniques.pdf
413 KiB
2022-03-17 - Process Overwriting - yet another variant.zip
73 KiB
2022-03-17 - Process-Hollowing Example.7z
229 KiB
2022-03-24 - Manipulating LastWriteTime without leaving traces in the NTFS USN Journal.pdf
106 KiB
2022-03-26 - Digging into PssCaptureSnapshot for LSASS Dumping.pdf
353 KiB
2022-03-30 - EventPipe - An IPC method to transfer binary data between processes using event objects.pdf
170 KiB
2022-04-02 - AudioTransmit - Transmitting data between computers using audio.pdf
282 KiB
2022-04-02 - Unmanaged Code Execution with .NET Dynamic PInvoke.pdf
851 KiB
2022-04-03 - FveApiDLL Abuse Demonstration.7z
287 KiB
2022-04-03 - NtdllPipe - Using cmd.exe to retrieve a clean version of ntdll.dll.pdf
117 KiB
2022-04-04 - AtlasC2 - Demonstrating A C2 in CSharp.zip
86 KiB
2022-04-04 - Sharing is Caring - Abusing Shared Sections for Code Injection.pdf
231 KiB
2022-04-09 - Demonstrating API Hooking in Rust.rar
1.9 MiB
2022-04-11 - Demonstrating Copying Data To A GPU - GpuMemoryAbuse.cpp
12 KiB
2022-04-15 - Make phishing great again VSTO office files are the new macro nightmare.pdf
3.0 MiB
2022-04-18 - A blueprint for evading industry leading endpoint protection in 2022.pdf
3.3 MiB
2022-04-18 - Implementing Global Injection and Hooking in Windows.pdf
467 KiB
2022-04-18 - Token Manipulation in Rust Demonation.zip
4.8 KiB
2022-04-18 - UACMe.zip
380 KiB
2022-04-19 - Dumping passwords using KRShowKeyMgr.PNG
179 KiB
2022-04-19 - HyperGuard Part 3 More SKPG Extents.pdf
1.1 MiB
2022-04-19 - Resolving System Service Numbers using the Exception Directory.pdf
116 KiB
2022-04-22 - Bypassing LSA Protection in Userland.pdf
656 KiB
2022-04-23 - Bypassing PESieve and Moneta The easy way.pdf
1.7 MiB
2022-04-27 - Alternate Method Of Contacting IPV4.PNG
26 KiB
2022-04-29 - One Year to IO Ring What Changed.pdf
1.9 MiB
2022-04-30 - Programmatically Hiding Windows Snapshots.7z
255 KiB
2022-05-01 - GetRawInputData Keylogger Demonstration.7z
1.9 KiB
2022-05-01 - Ipv4Fuscation Demonstration.7z
1.3 KiB
2022-05-02 - g_CiOptions in a Virtualized World.pdf
569 KiB
2022-05-05 - A very simple and alternative PID finder.pdf
212 KiB
2022-05-05 - Process Injection via Component Object Model (COM) IRundown-DoCallback().pdf
1.6 MiB
2022-05-05 - Studying Next Generation Malware - NightHawks Attempt At Obfuscate and Sleep.pdf
106 KiB
2022-05-08 - Demonstrating Process Injection in Rust - Rusty Memory LoadLibrary.zip
20 KiB
2022-05-09 - Spawning IE on Windows 11.PNG
97 KiB
2022-05-10 - Making NtCreateUserProcess Work.pdf
388 KiB
2022-05-14 - About XLL Phishing.zip
3.2 MiB
2022-05-16 - Demonstrating Reflective DLL Loading - KaynLdr.zip
114 KiB
2022-05-24 - Gargoyle x64 - DeepSleep.zip
173 KiB
2022-05-27 - Nls Code Injection Through The Registry.zip
71 KiB
2022-05-31 - Crashing Windows by Abusing NtRaiseHardError.PNG
168 KiB
2022-06-08 - Inside Get-AuthenticodeSignature.pdf
1.3 MiB
2022-06-14 - Demonstrating inline syscalls in Cplusplus.zip
12 KiB
2022-06-17 - Demonstrating Thread Stack Spoofing.zip
231 KiB
2022-06-17 - Sleep Obfuscation - Ekko.zip
3.2 KiB
2022-06-21 - WebView2 Cookie Stealer Demonstration.zip
21 MiB
2022-06-22 - Extracting Whitelisted Paths from Windows Defender ASR Rules.pdf
927 KiB
2022-06-25 - PE Resource section for Process Injection.zip
6.2 KiB
2022-06-26 - Protecting the Heap - Encryption and Hooks.pdf
432 KiB
2022-06-28 - The hidden side of Seclogon part 3 - Racing for LSASS dumps.pdf
928 KiB
2022-06-28 - Weaponizing and Abusing Hidden Functionalities Contained in Office Document Properties.pdf
440 KiB
2022-06-30 - CallStack Spoofer Demonstration.zip
16 KiB
2022-06-30 - Spoofing Call Stacks To Confuse EDRs.pdf
2.2 MiB
2022-07-05 - One I_O Ring to Rule Them All_ A Full Read_Write Exploit Primitive on Windows 11.pdf
497 KiB
2022-07-05 - Vulpes - Obfuscating Memory Regions with Timers.pdf
353 KiB
2022-07-05 - WMI Internals Part 1 - Understanding the Basics.pdf
1.0 MiB
2022-07-13 - Bluffy the AV Slayer.pdf
806 KiB
2022-07-14 - Lord Of The Ring0 - Part 1 Introduction.pdf
163 KiB
2022-07-16 - Process Injection using QueueUserAPC Technique in Windows.pdf
638 KiB
2022-07-17 - 30 second execution persistence with Winlogon.PNG
233 KiB
2022-07-19 - Creating Processes Using System Calls.7z
322 KiB
2022-07-26 - Understanding DISM - Servicing Stack Interaction.pdf
223 KiB
2022-07-29 - Running Exploit As Protected Process Light From Userland.pdf
240 KiB
2022-08-01 - DeathSleep - Demonstrating sleep obfuscation.7z
651 KiB
2022-08-01 - DLL Hijacking Windows Defender NisSrv.txt
1.4 KiB
2022-08-02 - Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service LSASS.pdf
553 KiB
2022-08-02 - Inside Windows Defender System Guard Runtime Monitor.pdf
431 KiB
2022-08-04 - API Resolving Obfuscation via Veh.zip
11 KiB
2022-08-04 - Lord Of The Ring0 - Part 2 A tale of routines IOCTLs and IRPs.pdf
368 KiB
2022-08-05 - Backdooring Office Structures Part 1 The Oldschool.pdf
916 KiB
2022-08-05 - Exploring the Windows Search Application Cache.zip
5.8 KiB
2022-08-07 - Tampering With Windows Syscalls.zip
33 KiB
2022-08-08 - Backdooring Office Structures Part 2 Payload Crumbs In Custom Parts.pdf
551 KiB
2022-08-08 - Manual Implementation of BlockDLLs and ACG.cpp
4.2 KiB
2022-08-16 - Demonstrating inline function importing in Cplusplus.zip
15 KiB
2022-08-16 - Understanding a New Mitigation Module Tampering Protection.pdf
1.9 MiB
2022-08-19 - Bypassing AppLocker by abusing HashInfo.pdf
968 KiB
2022-08-19 - Warbird Hook - Demonstrating shellcode injection and application hijacking.7z
18 KiB
2022-08-29 - DLL Sideloading ShellChromeAPI.PNG
75 KiB
2022-09-05 - DirectX and HyperV - An Offensive View.pdf
9.6 MiB
2022-09-05 - Inside the Windows Cache Manager.pdf
685 KiB
2022-09-05 - Shellcode Execution via CDefFolderMenu_Create2.c
1.2 KiB
2022-09-05 - Shellcode Execution via CopyFileTransacted.c
1.8 KiB
2022-09-05 - Shellcode Execution via DSA_EnumCallback.c
1.3 KiB
2022-09-05 - Shellcode Execution via EncryptedFileRaw.c
1.2 KiB
2022-09-05 - Shellcode Execution via EvtSubscribe_CVEEventWrite.c
1.6 KiB
2022-09-05 - Shellcode Execution via MagSetWindowTransform.c
1.4 KiB
2022-09-05 - Shellcode Execution via MessageBoxIndirect.c
1.3 KiB
2022-09-05 - Shellcode Execution via MFAddPeriodicCallback.c
1.2 KiB
2022-09-05 - Shellcode Execution via NotifyIpInterfaceChange.c
1.2 KiB
2022-09-05 - Shellcode Execution via NotifyTeredoPortChange.c
1.2 KiB
2022-09-05 - Shellcode Execution via NotifyUnicastIpAddressChange.c
1.2 KiB
2022-09-05 - Shellcode Execution via PerfStartProviderEx.c
1.4 KiB
2022-09-05 - Shellcode Execution via RegisterWaitForSingleObject.c
1.4 KiB
2022-09-05 - Shellcode Execution via SetWaitableTimer.c
1.2 KiB
2022-09-05 - Shellcode Execution via SHCreateThreadWithHandle.c
1.3 KiB
2022-09-05 - Shellcode Execution via StackWalk.c
1.6 KiB
2022-09-05 - Shellcode Execution via SymRegisterCallback.c
1.3 KiB
2022-09-05 - Shellcode Execution via TaskDialogIndirect.c
2.2 KiB
2022-09-05 - Shellcode Execution via WinHttpSetStatus.c
1.4 KiB
2022-09-09 - WriteProcessMemoryAPC - Write memory to a remote process using APC calls.pdf
106 KiB
2022-09-10 - Shellcode Execution via InternetSetStatusCallback.c
1.5 KiB
2022-09-11 - Shellcode Execution via CreateThreadPoolTimer.c
1.6 KiB
2022-09-11 - Shellcode Execution via CreateThreadPoolWork.c
1.3 KiB
2022-09-11 - Shellcode Execution via GetOpenFileName.c
1.8 KiB
2022-09-11 - Shellcode Execution via GetSaveFileName.c
1.8 KiB
2022-09-12 - Shellcode Execution via FindText.c
1.4 KiB
2022-09-12 - Shellcode Execution via OleUIBusy.c
1.3 KiB
2022-09-12 - Shellcode Execution via PrintDlg.c
1.2 KiB
2022-09-12 - Shellcode Execution via ReplaceText.c
1.4 KiB
2022-09-13 - Shellcode Execution via PageSetupDlg.c
1.3 KiB
2022-09-14 - Abusing Notepad Plugins for Evasion and Persistence.pdf
1.2 MiB
2022-09-14 - Myths About External C2.pdf
744 KiB
2022-09-15 - Shellcode Execution via ChooseFont.c
1.2 KiB
2022-09-15 - Shellcode Execution via TrySubmitThreadpoolCallback.c
1.2 KiB
2022-09-16 - Dissecting Windows Section Objects.pdf
1.3 MiB
2022-09-18 - Shellcode Execution via acmDriverEnum.c
1.1 KiB
2022-09-18 - Shellcode Execution via acmFilterChoose.c
1.5 KiB
2022-09-18 - Shellcode Execution via ChooseColor.c
1.2 KiB
2022-09-18 - Shellcode Execution via LineDDA.c
1.1 KiB
2022-09-18 - Shellcode Execution via NotifyRouteChange2.c
1.2 KiB
2022-09-18 - Shellcode Execution via RegisterWaitChainCOMCallback.c
1.2 KiB
2022-09-19 - Shellcode Execution via PdhBrowseCounters.c
1.3 KiB
2022-09-20 - Shellcode Execution via CertFindChainInStore.c
1.5 KiB
2022-09-20 - Shellcode Execution via ClusWorkerCreate.c
1.3 KiB
2022-09-20 - Shellcode Execution via PowerRegisterForEffectivePowerModeNotifications.c
1.3 KiB
2022-09-21 - Shellcode Execution via MI_Session_Close.c
1.4 KiB
2022-09-21 - Shellcode Execution via MI_Session_Invoke.c
2.0 KiB
2022-09-21 - Shellcode Execution via NotifyNetworkConnectivityHintChange.c
1.3 KiB
2022-09-21 - Shellcode Execution via WinBioCaptureSampleWithCallback.c
1.5 KiB
2022-09-21 - Shellcode Execution via WinBioEnrollCaptureWithCallback.c
1.4 KiB
2022-09-21 - Shellcode Execution via WinBioVerifyWithCallback.c
1.5 KiB
2022-09-21 - Shellcode Execution via WindowsInspectString.c
1.2 KiB
2022-09-23 - Shellcode Execution via FCICreate.c
1.2 KiB
2022-09-26 - Sacrificing Suspended Processes.7z
2.2 MiB
2022-09-27 - Constrained Language Mode Bypass When __PSLockDownPolicy Is Used.pdf
929 KiB
2022-09-28 - Demonstrating the VirusTotal C2.zip
15 KiB
2022-09-28 - MS Help 2 Primer.pdf
264 KiB
2022-10-01 - Manual ICMP implementation using NtDeviceIoControlFile.txt
6.1 KiB
2022-10-07 - Short term snapshot deletion via ExecuteScheduledSPPCreation.7z
218 KiB
2022-10-09 - Windows Server LDIF File Abuse for Silently Downloading Files.7z
277 KiB
2022-10-11 - Abusing the Windows Power Management API.7z
155 KiB
2022-10-11 - Custom Keyboard Layout Persistence.zip
906 KiB
2022-10-13 - Random Number Generation using IOCTL.txt
2.0 KiB
2022-10-15 - Shellcode Execution via EnumCalendarInfo.cpp
1.5 KiB
2022-10-18 - Changing memory protection using APC.pdf
186 KiB
2022-10-18 - Fantastic Rootkits And Where to Find Them Part 1.pdf
937 KiB
2022-10-20 - SharedMemUtils - A simple tool to automatically find vulnerabilities in shared memory objects.pdf
464 KiB
2022-10-22 - WAM BAM - Recovering Web Tokens From Office.7z
3.1 MiB
2022-10-28 - Using Windows IUIAutomation for spyware and other malicious purposes.html
12 KiB
2022-10-30 - Lord Of The Ring0 - Part 3 Sailing to the land of the user and debugging the ship.pdf
181 KiB
2022-10-31 - Heavens Gate in CSharp.7z
12 KiB
2022-10-31 - Resolving syscalls in CSharp.7z
20 KiB
2022-11-02 - IIS Pool Credential Dumping via undocumented command line arguments.7z
102 KiB
2022-11-16 - Bypassing AV-EDR Hooks via Vectored Syscall.pdf
1.5 MiB
2022-11-19 - An Exercise in Dynamic Analysis.pdf
3.7 MiB
2022-11-22 - x64 return address spoofing.7z
139 KiB
2022-11-23 - An End to KASLR Bypasses.pdf
329 KiB
2022-12-04 - SilentMoonWalk - Demonstrating call stack spoofing.zip
284 KiB
2022-12-07 - Programmatically Deleting Shadow Volumes - Xaoc.7z
10 KiB
2022-12-08 - Hooking System Calls in Windows 11 22H2 like Avast Antivirus. Research, analysis and bypass.pdf
723 KiB
2022-12-10 - StealthHook - A method for hooking a function without modifying memory protection.pdf
248 KiB
2022-12-16 - Polyshell - Bash, Batch, and Powershell Polyglot.zip
34 KiB
2022-12-18 - Diving into Intel Killer bloatware part 1.pdf
1.4 MiB
2022-12-18 - Shellcode Execution via GrayString.c
1.1 KiB
2022-12-18 - Shellcode Execution via SHBrowseForFolder.c
1.3 KiB
2022-12-19 - Shellcode Execution via DirectDrawEnumerateExA.c
1.1 KiB
2022-12-19 - Shellcode Execution via SetupIterateCabinet.c
1.2 KiB
2022-12-20 - Shellcode Execution via DnsStartMulticastQuery.c
1.5 KiB
2022-12-20 - Shellcode Execution via WriteEncryptedFileRaw.c
1.6 KiB
2022-12-23 - Ctrl Injection Collection.7z
554 KiB
2022-12-23 - Simple PE Loader.7z
63 KiB
2022-12-29 - Bootkitting Windows Sandbox.pdf
306 KiB
2022-12-30 - Code Execution against Windows HVCI.pdf
680 KiB
2023-01-04 - Investigating Filter Communication Ports.pdf
1.0 MiB
2023-01-11 - SelfDebug - A useless anti-debug trick by forcing a process to debug itself.pdf
276 KiB
2023-01-20 - Shellcode Execution via RoInspectCapturedStackBackTrace.c
1.3 KiB
2023-01-20 - Shellcode Execution via RoInspectThreadErrorInfo.c
1.2 KiB
2023-01-21 - Shellcode Execution via NPAddConnection3.c
1.5 KiB
2023-01-21 - Shellcode Execution via WscRegisterForChanges.c
2.2 KiB
2023-01-23 - Exfiltrating data using Powershell and WAV files.7z
3.6 KiB
2023-01-24 - Persistence via VSCode Profile Abuse.7z
100 KiB
2023-01-28 - Shellcode Execution via acmFormatTagEnum.c
1.3 KiB
2023-01-28 - Shellcode Execution via DrawState.c
1.2 KiB
2023-01-28 - Shellcode Execution via WriteEncryptedFileRaw.c
1.6 KiB
2023-01-29 - Indirect Syscall is Dead Long Live Custom Call Stacks.7z
958 KiB
2023-01-29 - Shellcode Execution via BindImageEx.c
1.2 KiB
2023-01-29 - Shellcode Execution via CertCreateContext.c
1.4 KiB
2023-01-29 - Shellcode Execution via CertEnumPhysicalStore.c
1.2 KiB
2023-01-29 - Shellcode Execution via DdeInitialize.c
1.3 KiB
2023-01-29 - Shellcode Execution via DnsServiceBrowse.c
1.4 KiB
2023-01-29 - Shellcode Execution via SetupInstallFile.c
1.6 KiB
2023-01-29 - Shellcode Execution via waveOutOpen.c
1.4 KiB
2023-01-30 - Abusing Exceptions for Code Execution Part 2.pdf
1004 KiB
2023-01-30 - Shellcode Execution via MiniDumpWriteDump.c
1.3 KiB
2023-01-31 - Lets Go VS Code - Using VS Code as a Reverse Shell.pdf
543 KiB
2023-02-01 - Weird things I learned while writing an x86 emulator.pdf
181 KiB
2023-02-03 - Windows Domain Controller NTDSUTIL activate instance abuse.PNG
177 KiB
2023-02-06 - Diving Deeper Into Pre-created Computer Accounts.pdf
2.0 MiB
2023-02-07 - Demonstrating Unhooking NTDLL from Disk.7z
5.0 KiB
2023-02-07 - Demonstrating Unhooking NTDLL from KnownDlls.7z
9.0 KiB
2023-02-07 - Demonstrating Unhooking NTDLL from Remote Server.7z
6.7 KiB
2023-02-07 - Demonstrating Unhooking NTDLL from Suspended Process.7z
5.4 KiB
2023-02-07 - Home Grown Red Team - Lets Make Some OneNote Phishing Attachments.pdf
1.4 MiB
2023-02-09 - Transitioning from User Mode to Kernel mode - Extravagant Prick.txt
6.4 KiB
2023-02-14 - Adopting Position Independent Shellcodes from Object Files in Memory for Threadless Injection.pdf
981 KiB
2023-02-24 - Lord Of The Ring0 - Part 4 The call back home.pdf
413 KiB
2023-03-16 - Minimal Executables.pdf
419 KiB
2023-03-19 - Different ways to create a process.html
80 KiB
2023-03-21 - EkkoEx Sleep obfuscation.txt
4.9 KiB
2023-04-11 - Stepping Insyde System Management Mode.pdf
627 KiB
2023-04-17 - An in-depth look at the Golang Windows calls.pdf
1004 KiB
2023-04-18 - Diving into Intel Killer bloatware part 2.pdf
542 KiB
2023-04-18 - Process injection in 2023 evading leading EDRs.pdf
5.0 MiB
2023-04-25 - Demonstrating stack encryption.zip
5.0 KiB
2023-05-02 - Preventing application creation by IFEO keys.png
94 KiB
2023-05-03 - Exploring Impersonation through the Named Pipe Filesystem Driver.pdf
1.1 MiB
2023-05-04 - Fantastic Rootkits and Where to Find Them Part 2.pdf
3.1 MiB
2023-05-17 - VBA resolving exports in runtime without NtQueryInformationProcess or GetProcAddress.pdf
996 KiB
2023-05-20 - Demonstrating using SMS as a C2.zip
17 KiB
2023-06-01 - Improving the stealthiness of memory injections techniques.pdf
1.0 MiB
2023-06-05 - Abusing undocumented features to spoof PE section headers.pdf
225 KiB
2023-06-05 - Terminator - Demonstrating how to kill EDR processes using a driver.zip
98 KiB
2023-06-09 - Finding and exploiting process killer drivers with LOL for 3000 dollars.7z
1.1 MiB
2023-06-09 - Finding and exploiting process killer drivers with LOL for 3000 dollars.pdf
850 KiB
2023-06-09 - No Alloc, No Problem - Leveraging Program Entry Points for Process Injection.pdf
1.3 MiB
2023-06-18 - DCOMHijack - Demonstrating lateral movement using DCOM and DLL hijacking.zip
198 KiB
2023-06-27 - Process Mockingjay Echoing RWX In Userland To Achieve Code Execution.pdf
7.2 MiB
2023-07-01 - Demonstrating a Rust based Bootkit.zip
1.6 MiB
2023-07-14 - Oh-No a Vulnerability and PoC demonstration in a popular Minecraft Anticheat tool.pdf
2.7 MiB
2023-07-15 - Poch Poch is this thing on - Bypass AMSI with Divide and Conquer.pdf
2.3 MiB
2023-07-19 - Escalating Privileges via Third-Party Windows Installers.pdf
3.3 MiB
2023-07-23 - Malware via VHD Files, an Excellent Choice.pdf
322 KiB
2023-07-25 - Advanced Module Stomping & Heap Stack Encryption.pdf
3.8 MiB
2023-07-25 - Prefetch - The Little Snitch That Tells on You.pdf
1.7 MiB
2023-07-26 - WSPCoerce - PoC to allow authentication from Windows hosts using MS-WSP.zip
59 KiB
2023-07-27 - Kerberos UAC Bypass - Abusing Kerberos Tickets for UAC Bypasses.zip
3.0 MiB
2023-07-29 - Lord Of The Ring0 - Part 5 Sarumans Manipulation.pdf
651 KiB
2023-08-04 - Advanced persistence via Shell Extensions.7z
168 MiB
2023-08-13 - LAPS 2.0 Internals.pdf
3.3 MiB
2023-08-15 - Dll Notification Injection.7z
1.8 MiB
2023-08-16 - Understanding Syscalls Direct and Indirect and Cobalt Strike Implementation.pdf
1.9 MiB
2023-08-23 - Demonstrating how IIS decrypts AppPool credentials.7z
4.1 KiB
2023-08-23 - Demystifying DLL Hijacking Understanding the Intricate World of Dynamic Link Library Attacks.pdf
208 KiB
2023-08-27 - Demonstrating Parent Process ID Spoofing.txt
15 KiB
2023-08-28 - Uac bypass via UIPI or Windows Task Manager.txt
7.5 KiB
2023-08-29 - DevTunnels for C2.pdf
2.1 MiB
2023-09-05 - Demonstrating MockingJay with a POC and BOF.7z
93 MiB
2023-09-06 - How to Troll an AV.7z
4.8 KiB
2023-09-10 - GIF Steganography from First Principles.pdf
1.6 MiB
2023-09-11 - MATLAB Reverse Shell.7z
2.0 KiB
2023-09-12 - Peeling back the curtain with call stacks.pdf
7.3 MiB
2023-09-14 - Bypassing UAC with SSPI Datagram Contexts.pdf
1.3 MiB
2023-09-15 - An Introduction into Stack Spoofing.pdf
781 KiB
2023-09-15 - Hypervisor Detection with SystemHypervisorDetailInformation.pdf
443 KiB
2023-09-20 - Windows Authentication - Credential Providers - Part 1.pdf
1.4 MiB
2023-10-02 - Process Injection using NtSetInformationProcess.pdf
835 KiB
2023-10-03 - Lets Go into the rabbit hole - the challenges of dynamically hooking Golang programs.pdf
2.0 MiB
2023-10-03 - LPE with MSI Installers.pdf
6.0 MiB
2023-10-04 - Windows Authentication - Credential Providers - Part 2.pdf
2.3 MiB
2023-10-05 - Windows Authentication - Credential Providers - Part 2.pdf
1.8 MiB
2023-10-06 - Reflective call stack detections and evasions.pdf
3.2 MiB
2023-10-09 - Demonstrating Sleep Obfuscation - KrakenMask.7z
54 KiB
2023-11-06 - Running PEs Inline Without a Console.pdf
765 KiB
2023-11-12 - How to dig into the CLR.pdf
1.2 MiB
2023-11-22 - ETW internals for security research and forensics.7z
442 KiB
2023-11-29 - The Art of Windows Persistence.pdf
6.1 MiB
2023-11-29 - Unwind - Callstack spoofing in Rust.7z
114 KiB
2023-12-06 - Process Injection Techniques Using Windows Thread Pools.7z
4.7 MiB
2023-12-19 - SignToolEx - code signing with leaked certs and abusing MS detours.zip
458 KiB
2023-12-21 - InsightEngineering - Advanced Windows Debugging.zip
34 MiB
2023-12-24 - Arbitrary Command Execution Via Windows Kit's StandaloneRunner.pdf
386 KiB
2023-12-25 - An Introduction to Bypassing User Mode EDR Hooks.pdf
352 KiB
2023-12-26 - A little known secret of runonceexe 32-bit.pdf
64 KiB
2023-12-27 - A little known secret of regsvr32exe take two.pdf
76 KiB
2023-12-29 - Usermode encryption but only LOCALSYSTEM can decrypt.7z
172 KiB
2023-12-31 - Compression using undocumented RDP APIs.7z
3.1 KiB
2024-01-06 - A little known secret of fondue dot exe.pdf
63 KiB
2024-01-06 - Token stealing with Syscalls only.7z
67 KiB
2024-01-15 - Undocumented DISM properties.7z
298 KiB
2024-01-22 - Demonstrating proxy DLL loading.zip
5.8 KiB
2024-01-23 - Windows Event Log service DoS.zip
1.6 MiB
2024-01-24 - Demonstrating Remote TLS Callback Injection.zip
9.7 KiB
2024-01-24 - How to perform a Complete Process Hollowing.pdf
4.0 MiB
2024-01-31 - Abusing the GPU for Malware with OpenCL.pdf
298 KiB
2024-02-01 - Unmanaged .NET Patching.pdf
164 KiB
2024-02-02 - Bypassing EDRs With EDR-Preloading.pdf
452 KiB
2024-02-02 - GetProcAddress usage via ordinal.7z
62 KiB
2024-02-06 - Exploiting a vulnerable Minifilter driver to create a process killer.7z
112 KiB
2024-02-08 - Bypassing ApplyOnce limitation in GPO with key removal.7z
227 KiB
2024-02-08 - Deep Dive Into Exploiting Windows Thread Pools.7z
336 KiB
2024-02-08 - Disabling System Event Logs with IDataCollectorSet.7z
79 KiB
2024-02-08 - Executing CSharp Assemblies from C code.pdf
431 KiB
2024-02-09 - Sudo On Windows - Quick Rundown.pdf
145 KiB
2024-02-12 - Hypervisor enforced security policies for NTOS secure kernel and a child partition.pdf
666 KiB
2024-02-12 - Why Windows cant follow WSL symlinks.pdf
632 KiB
2024-02-16 - Beyond Process and Object Callbacks - An Unconventional Method.pdf
4.0 MiB
2024-02-16 - InflativeLoading.7z
1.8 MiB
2024-02-24 - iExpress LOLBINS and Diamond seds.7z
273 KiB
2024-02-25 - Keylogging in the Windows kernel with undocumented data structures.pdf
1.1 MiB
2024-02-27 - What is Regedt32.EXE.7z
186 KiB
2024-02-28 - MutationGate.7z
165 KiB
2024-03-03 - A Trip Down Memory Lane - A history of AV evasion.pdf
2.9 MiB
2024-03-03 - Explorer.exe LOLBIN and persistence.pdf
56 KiB
2024-03-08- Manipulating Token Attribute structures.7z
186 KiB
2024-03-09 - YARP as a C2 Redirector.pdf
522 KiB
2024-03-15 - Capping process CPU usage.7z
122 KiB
2024-03-18 - Abusing SeTrustedCredmanAccessPrivilege to dump user creds.zip
10 KiB
2024-03-23 - Anti-Anti-Rootkit Techniques - Part I UnKovering mapped rootkits.pdf
1.1 MiB
2024-04-12 - Understanding ETW Patching.pdf
886 KiB
2024-04-19 - Detecting Sandboxes Without Syscalls.pdf
185 KiB
2024-06-09 - Bypassing EDR NTDSdit protection using BlueTeam tools.pdf
628 KiB
2024-06-11 - Lets Go into the rabbit hole part 2 - the challenges of dynamically hooking Golang programs.pdf
863 KiB
2024-08-04 - Abusing the search-ms URI protocol handler.pdf
4.5 MiB
2024-08-08 - Abusing Windows Hello without a severed hand.7z
2.8 MiB
2024-08-09 - Blocking EDR Drivers with WDAC policies.7z
218 KiB
2024-08-10 - ShimMe - Manipulating Shim and Office for Code Injection.7z
47 KiB
2024-08-11 - Blocking EDR drivers with HVCIDisallowedimage.7z
424 KiB
2024-08-11 - DriverJack.7z
9.1 MiB
2024-08-13 - Abusing AVEDR Exclusions to Evade Detections.pdf
3.5 MiB
2024-08-14 - Tricks with Microsoft Word and Sandboxes.pdf
162 KiB
2024-08-15 - Offline SAM Editing.pdf
301 KiB
2024-08-17 - HookChain - A new perspective for Bypassing EDR Solutions.pdf
14 MiB
2024-08-19 - DRMBIN - Prevent binaries from running on other machines.zip
15 KiB
2024-08-26 - DLL Sideloading ith LicenseDiag.exe.7z
130 KiB
2024-08-30 - Evil MSI A story about vulnerabilities in MSI Files.pdf
3.8 MiB
2024-08-31 - Finding open file handles in PS.7z
95 KiB
2024-09-03 - Rundll32 and Phantom DLL lolbins.7z
107 KiB
2024-09-04 - Rundll32 and Phantom DLL lolbins, 32-bit version.7z
64 KiB
2024-09-12 - Proof of Concept - Transforming an EXE or DLL to Shellcode.7z
5.8 KiB
2024-09-13 - ScriptBlock Smuggling.pdf
1.6 MiB
2024-09-16 - Kernel ETW is the bestnbspETW.pdf
812 KiB
2024-09-20 - Anti-Anti-Rootkit Techniques - Part II Stomped Drivers and Hidden Threads.pdf
916 KiB
2024-09-28 - Notes on unprivileged access to Bitlocker.zip
425 KiB
2024-10-04 - Notes on xWizard.exe and xWizards.dll.png
88 KiB
2024-10-09 - XBL Live Game Save DCOM for lateral movement.zip
530 KiB
2024-10-15 - Introducing Early Cascade Injection from Windows process creation to stealthy injection.pdf
1.6 MiB
2024-10-22 - Offensive Groovy programming.pdf
408 KiB
2024-10-22 - Reading BitLocker numerical passwords via API.zip
81 KiB
2024-10-24 - EmbedPayloadInPng.zip
49 KiB
2024-10-27 - ExecutePeFromPngViaLNK.zip
52 KiB
2024-10-30 - EV code signing with pfx in 2024.pdf
2.2 MiB
2024-10-31 - SysVEHSyscalls in Rust.zip
16 KiB
2024-11-09 - Structured Storage and Compound Files.pdf
248 KiB
2024-11-09 - Using VBS enclaves for anti-cheat purposes.pdf
2.3 MiB