2024-11-09 - Using VBS enclaves for anti-cheat purposes.pdf
Size:
2.29 MB
Last modified:
2024/11/13
2024-11-09 - Structured Storage and Compound Files.pdf
Size:
0.24 MB
Last modified:
2024/11/13
2024-10-31 - SysVEHSyscalls in Rust.zip
Size:
0.02 MB
Last modified:
2024/11/13
2024-10-30 - EV code signing with pfx in 2024.pdf
Size:
2.18 MB
Last modified:
2024/11/13
2024-10-27 - ExecutePeFromPngViaLNK.zip
Size:
0.05 MB
Last modified:
2024/11/13
2024-10-24 - EmbedPayloadInPng.zip
Size:
0.05 MB
Last modified:
2024/11/13
2024-10-22 - Reading BitLocker numerical passwords via API.zip
Size:
0.08 MB
Last modified:
2024/11/13
2024-10-22 - Offensive Groovy programming.pdf
Size:
0.40 MB
Last modified:
2024/11/13
2024-10-15 - Introducing Early Cascade Injection from Windows process creation to stealthy injection.pdf
Size:
1.61 MB
Last modified:
2024/10/15
2024-10-09 - XBL Live Game Save DCOM for lateral movement.zip
Size:
0.52 MB
Last modified:
2024/11/13
2024-10-04 - Notes on xWizard.exe and xWizards.dll.png
Size:
0.09 MB
Last modified:
2024/11/13
2024-09-28 - Notes on unprivileged access to Bitlocker.zip
Size:
0.41 MB
Last modified:
2024/11/13
2024-09-20 - Anti-Anti-Rootkit Techniques - Part II Stomped Drivers and Hidden Threads.pdf
Size:
0.89 MB
Last modified:
2024/11/13
2024-09-16 - Kernel ETW is the bestnbspETW.pdf
Size:
0.79 MB
Last modified:
2024/11/13
2024-09-13 - ScriptBlock Smuggling.pdf
Size:
1.58 MB
Last modified:
2024/11/13
2024-09-12 - Proof of Concept - Transforming an EXE or DLL to Shellcode.7z
Size:
0.01 MB
Last modified:
2024/11/13
2024-09-04 - Rundll32 and Phantom DLL lolbins, 32-bit version.7z
Size:
0.06 MB
Last modified:
2024/10/15
2024-09-03 - Rundll32 and Phantom DLL lolbins.7z
Size:
0.10 MB
Last modified:
2024/10/15
2024-08-31 - Finding open file handles in PS.7z
Size:
0.09 MB
Last modified:
2024/10/15
2024-08-30 - Evil MSI A story about vulnerabilities in MSI Files.pdf
Size:
3.82 MB
Last modified:
2024/10/15
2024-08-26 - DLL Sideloading ith LicenseDiag.exe.7z
Size:
0.13 MB
Last modified:
2024/10/15
2024-08-19 - DRMBIN - Prevent binaries from running on other machines.zip
Size:
0.01 MB
Last modified:
2024/10/15
2024-08-17 - HookChain - A new perspective for Bypassing EDR Solutions.pdf
Size:
14.38 MB
Last modified:
2024/10/15
2024-08-15 - Offline SAM Editing.pdf
Size:
0.29 MB
Last modified:
2024/10/15
2024-08-14 - Tricks with Microsoft Word and Sandboxes.pdf
Size:
0.16 MB
Last modified:
2024/10/15
2024-08-13 - Abusing AVEDR Exclusions to Evade Detections.pdf
Size:
3.55 MB
Last modified:
2024/10/15
2024-08-11 - DriverJack.7z
Size:
9.13 MB
Last modified:
2024/10/15
2024-08-11 - Blocking EDR drivers with HVCIDisallowedimage.7z
Size:
0.41 MB
Last modified:
2024/10/15
2024-08-10 - ShimMe - Manipulating Shim and Office for Code Injection.7z
Size:
0.05 MB
Last modified:
2024/10/15
2024-08-09 - Blocking EDR Drivers with WDAC policies.7z
Size:
0.21 MB
Last modified:
2024/10/15
2024-08-08 - Abusing Windows Hello without a severed hand.7z
Size:
2.83 MB
Last modified:
2024/10/15
2024-08-04 - Abusing the search-ms URI protocol handler.pdf
Size:
4.51 MB
Last modified:
2024/10/15
2024-06-11 - Lets Go into the rabbit hole part 2 - the challenges of dynamically hooking Golang programs.pdf
Size:
0.84 MB
Last modified:
2024/10/15
2024-06-09 - Bypassing EDR NTDSdit protection using BlueTeam tools.pdf
Size:
0.61 MB
Last modified:
2024/10/15
2024-04-19 - Detecting Sandboxes Without Syscalls.pdf
Size:
0.18 MB
Last modified:
2024/11/13
2024-04-12 - Understanding ETW Patching.pdf
Size:
0.87 MB
Last modified:
2024/10/15
2024-03-23 - Anti-Anti-Rootkit Techniques - Part I UnKovering mapped rootkits.pdf
Size:
1.08 MB
Last modified:
2024/10/15
2024-03-18 - Abusing SeTrustedCredmanAccessPrivilege to dump user creds.zip
Size:
0.01 MB
Last modified:
2024/10/15
2024-03-15 - Capping process CPU usage.7z
Size:
0.12 MB
Last modified:
2024/10/15
2024-03-09 - YARP as a C2 Redirector.pdf
Size:
0.51 MB
Last modified:
2024/10/15
2024-03-08- Manipulating Token Attribute structures.7z
Size:
0.18 MB
Last modified:
2024/10/15
2024-03-03 - Explorer.exe LOLBIN and persistence.pdf
Size:
0.05 MB
Last modified:
2024/10/15
2024-03-03 - A Trip Down Memory Lane - A history of AV evasion.pdf
Size:
2.91 MB
Last modified:
2024/10/15
2024-02-28 - MutationGate.7z
Size:
0.16 MB
Last modified:
2024/10/15
2024-02-27 - What is Regedt32.EXE.7z
Size:
0.18 MB
Last modified:
2024/10/15
2024-02-25 - Keylogging in the Windows kernel with undocumented data structures.pdf
Size:
1.13 MB
Last modified:
2024/10/15
2024-02-24 - iExpress LOLBINS and Diamond seds.7z
Size:
0.27 MB
Last modified:
2024/10/15
2024-02-16 - InflativeLoading.7z
Size:
1.82 MB
Last modified:
2024/10/15
2024-02-16 - Beyond Process and Object Callbacks - An Unconventional Method.pdf
Size:
3.98 MB
Last modified:
2024/10/15
2024-02-12 - Why Windows cant follow WSL symlinks.pdf
Size:
0.62 MB
Last modified:
2024/10/15
2024-02-12 - Hypervisor enforced security policies for NTOS secure kernel and a child partition.pdf
Size:
0.65 MB
Last modified:
2024/10/15
2024-02-09 - Sudo On Windows - Quick Rundown.pdf
Size:
0.14 MB
Last modified:
2024/10/15
2024-02-08 - Executing CSharp Assemblies from C code.pdf
Size:
0.42 MB
Last modified:
2024/10/15
2024-02-08 - Disabling System Event Logs with IDataCollectorSet.7z
Size:
0.08 MB
Last modified:
2024/10/15
2024-02-08 - Deep Dive Into Exploiting Windows Thread Pools.7z
Size:
0.33 MB
Last modified:
2024/10/15
2024-02-08 - Bypassing ApplyOnce limitation in GPO with key removal.7z
Size:
0.22 MB
Last modified:
2024/10/15
2024-02-06 - Exploiting a vulnerable Minifilter driver to create a process killer.7z
Size:
0.11 MB
Last modified:
2024/10/15
2024-02-02 - GetProcAddress usage via ordinal.7z
Size:
0.06 MB
Last modified:
2024/10/15
2024-02-02 - Bypassing EDRs With EDR-Preloading.pdf
Size:
0.44 MB
Last modified:
2024/10/15
2024-02-01 - Unmanaged .NET Patching.pdf
Size:
0.16 MB
Last modified:
2024/10/15
2024-01-31 - Abusing the GPU for Malware with OpenCL.pdf
Size:
0.29 MB
Last modified:
2024/11/13
2024-01-24 - How to perform a Complete Process Hollowing.pdf
Size:
3.96 MB
Last modified:
2024/10/15
2024-01-24 - Demonstrating Remote TLS Callback Injection.zip
Size:
0.01 MB
Last modified:
2024/10/15
2024-01-23 - Windows Event Log service DoS.zip
Size:
1.56 MB
Last modified:
2024/10/15
2024-01-22 - Demonstrating proxy DLL loading.zip
Size:
0.01 MB
Last modified:
2024/10/15
2024-01-15 - Undocumented DISM properties.7z
Size:
0.29 MB
Last modified:
2024/10/15
2024-01-06 - Token stealing with Syscalls only.7z
Size:
0.07 MB
Last modified:
2024/10/15
2024-01-06 - A little known secret of fondue dot exe.pdf
Size:
0.06 MB
Last modified:
2024/10/15
2023-12-31 - Compression using undocumented RDP APIs.7z
Size:
0.00 MB
Last modified:
2024/10/15
2023-12-29 - Usermode encryption but only LOCALSYSTEM can decrypt.7z
Size:
0.17 MB
Last modified:
2024/10/15
2023-12-27 - A little known secret of regsvr32exe take two.pdf
Size:
0.07 MB
Last modified:
2024/10/15
2023-12-26 - A little known secret of runonceexe 32-bit.pdf
Size:
0.06 MB
Last modified:
2024/10/15
2023-12-25 - An Introduction to Bypassing User Mode EDR Hooks.pdf
Size:
0.34 MB
Last modified:
2024/10/15
2023-12-24 - Arbitrary Command Execution Via Windows Kit's StandaloneRunner.pdf
Size:
0.38 MB
Last modified:
2024/10/15
2023-12-21 - InsightEngineering - Advanced Windows Debugging.zip
Size:
34.06 MB
Last modified:
2024/10/15
2023-12-19 - SignToolEx - code signing with leaked certs and abusing MS detours.zip
Size:
0.45 MB
Last modified:
2024/10/15
2023-12-06 - Process Injection Techniques Using Windows Thread Pools.7z
Size:
4.74 MB
Last modified:
2024/10/15
2023-11-29 - Unwind - Callstack spoofing in Rust.7z
Size:
0.11 MB
Last modified:
2024/10/15
2023-11-29 - The Art of Windows Persistence.pdf
Size:
6.14 MB
Last modified:
2024/10/15
2023-11-22 - ETW internals for security research and forensics.7z
Size:
0.43 MB
Last modified:
2024/10/15
2023-11-12 - How to dig into the CLR.pdf
Size:
1.24 MB
Last modified:
2024/10/15
2023-11-06 - Running PEs Inline Without a Console.pdf
Size:
0.75 MB
Last modified:
2024/10/15
2023-10-09 - Demonstrating Sleep Obfuscation - KrakenMask.7z
Size:
0.05 MB
Last modified:
2024/10/15
2023-10-06 - Reflective call stack detections and evasions.pdf
Size:
3.18 MB
Last modified:
2024/10/15
2023-10-05 - Windows Authentication - Credential Providers - Part 2.pdf
Size:
1.83 MB
Last modified:
2024/10/15
2023-10-04 - Windows Authentication - Credential Providers - Part 2.pdf
Size:
2.26 MB
Last modified:
2024/10/15
2023-10-03 - Lets Go into the rabbit hole - the challenges of dynamically hooking Golang programs.pdf
Size:
2.03 MB
Last modified:
2024/10/15
2023-10-03 - LPE with MSI Installers.pdf
Size:
6.05 MB
Last modified:
2024/10/15
2023-10-02 - Process Injection using NtSetInformationProcess.pdf
Size:
0.82 MB
Last modified:
2024/10/15
2023-09-20 - Windows Authentication - Credential Providers - Part 1.pdf
Size:
1.42 MB
Last modified:
2024/10/15
2023-09-15 - Hypervisor Detection with SystemHypervisorDetailInformation.pdf
Size:
0.43 MB
Last modified:
2024/10/15
2023-09-15 - An Introduction into Stack Spoofing.pdf
Size:
0.76 MB
Last modified:
2024/10/15
2023-09-14 - Bypassing UAC with SSPI Datagram Contexts.pdf
Size:
1.32 MB
Last modified:
2024/10/15
2023-09-12 - Peeling back the curtain with call stacks.pdf
Size:
7.30 MB
Last modified:
2024/10/15
2023-09-11 - MATLAB Reverse Shell.7z
Size:
0.00 MB
Last modified:
2024/10/15
2023-09-10 - GIF Steganography from First Principles.pdf
Size:
1.65 MB
Last modified:
2024/10/15
2023-09-06 - How to Troll an AV.7z
Size:
0.00 MB
Last modified:
2024/10/15
2023-09-05 - Demonstrating MockingJay with a POC and BOF.7z
Size:
93.02 MB
Last modified:
2024/10/15
2023-08-29 - DevTunnels for C2.pdf
Size:
2.12 MB
Last modified:
2024/10/15
2023-08-28 - Uac bypass via UIPI or Windows Task Manager.txt
Size:
0.01 MB
Last modified:
2024/10/15
2023-08-27 - Demonstrating Parent Process ID Spoofing.txt
Size:
0.01 MB
Last modified:
2024/10/15
2023-08-23 - Demystifying DLL Hijacking Understanding the Intricate World of Dynamic Link Library Attacks.pdf
Size:
0.20 MB
Last modified:
2024/10/15
2023-08-23 - Demonstrating how IIS decrypts AppPool credentials.7z
Size:
0.00 MB
Last modified:
2024/10/15
2023-08-16 - Understanding Syscalls Direct and Indirect and Cobalt Strike Implementation.pdf
Size:
1.95 MB
Last modified:
2024/10/15
2023-08-15 - Dll Notification Injection.7z
Size:
1.83 MB
Last modified:
2024/10/15
2023-08-13 - LAPS 2.0 Internals.pdf
Size:
3.28 MB
Last modified:
2024/10/15
2023-08-04 - Advanced persistence via Shell Extensions.7z
Size:
168.35 MB
Last modified:
2024/10/15
2023-07-29 - Lord Of The Ring0 - Part 5 Sarumans Manipulation.pdf
Size:
0.64 MB
Last modified:
2024/10/15
2023-07-27 - Kerberos UAC Bypass - Abusing Kerberos Tickets for UAC Bypasses.zip
Size:
3.03 MB
Last modified:
2024/10/15
2023-07-26 - WSPCoerce - PoC to allow authentication from Windows hosts using MS-WSP.zip
Size:
0.06 MB
Last modified:
2024/10/15
2023-07-25 - Prefetch - The Little Snitch That Tells on You.pdf
Size:
1.68 MB
Last modified:
2024/10/15
2023-07-25 - Advanced Module Stomping & Heap Stack Encryption.pdf
Size:
3.79 MB
Last modified:
2024/10/15
2023-07-23 - Malware via VHD Files, an Excellent Choice.pdf
Size:
0.31 MB
Last modified:
2024/10/15
2023-07-19 - Escalating Privileges via Third-Party Windows Installers.pdf
Size:
3.30 MB
Last modified:
2024/10/15
2023-07-15 - Poch Poch is this thing on - Bypass AMSI with Divide and Conquer.pdf
Size:
2.33 MB
Last modified:
2024/10/15
2023-07-14 - Oh-No a Vulnerability and PoC demonstration in a popular Minecraft Anticheat tool.pdf
Size:
2.74 MB
Last modified:
2024/10/15
2023-07-01 - Demonstrating a Rust based Bootkit.zip
Size:
1.58 MB
Last modified:
2024/10/15
2023-06-27 - Process Mockingjay Echoing RWX In Userland To Achieve Code Execution.pdf
Size:
7.18 MB
Last modified:
2024/10/15
2023-06-18 - DCOMHijack - Demonstrating lateral movement using DCOM and DLL hijacking.zip
Size:
0.19 MB
Last modified:
2024/10/15
2023-06-09 - No Alloc, No Problem - Leveraging Program Entry Points for Process Injection.pdf
Size:
1.31 MB
Last modified:
2024/10/15
2023-06-09 - Finding and exploiting process killer drivers with LOL for 3000 dollars.pdf
Size:
0.83 MB
Last modified:
2024/10/15
2023-06-09 - Finding and exploiting process killer drivers with LOL for 3000 dollars.7z
Size:
1.05 MB
Last modified:
2024/10/15
2023-06-05 - Terminator - Demonstrating how to kill EDR processes using a driver.zip
Size:
0.10 MB
Last modified:
2024/10/15
2023-06-05 - Abusing undocumented features to spoof PE section headers.pdf
Size:
0.22 MB
Last modified:
2024/10/15
2023-06-01 - Improving the stealthiness of memory injections techniques.pdf
Size:
1.02 MB
Last modified:
2024/10/15
2023-05-20 - Demonstrating using SMS as a C2.zip
Size:
0.02 MB
Last modified:
2024/10/15
2023-05-17 - VBA resolving exports in runtime without NtQueryInformationProcess or GetProcAddress.pdf
Size:
0.97 MB
Last modified:
2024/10/15
2023-05-04 - Fantastic Rootkits and Where to Find Them Part 2.pdf
Size:
3.07 MB
Last modified:
2024/10/15
2023-05-03 - Exploring Impersonation through the Named Pipe Filesystem Driver.pdf
Size:
1.11 MB
Last modified:
2024/10/15
2023-05-02 - Preventing application creation by IFEO keys.png
Size:
0.09 MB
Last modified:
2024/10/15
2023-04-25 - Demonstrating stack encryption.zip
Size:
0.00 MB
Last modified:
2024/10/15
2023-04-18 - Process injection in 2023 evading leading EDRs.pdf
Size:
5.04 MB
Last modified:
2024/10/15
2023-04-18 - Diving into Intel Killer bloatware part 2.pdf
Size:
0.53 MB
Last modified:
2024/10/15
2023-04-17 - An in-depth look at the Golang Windows calls.pdf
Size:
0.98 MB
Last modified:
2024/10/15
2023-04-11 - Stepping Insyde System Management Mode.pdf
Size:
0.61 MB
Last modified:
2024/10/15
2023-03-21 - EkkoEx Sleep obfuscation.txt
Size:
0.00 MB
Last modified:
2024/10/15
2023-03-19 - Different ways to create a process.html
Size:
0.08 MB
Last modified:
2024/10/15
2023-03-16 - Minimal Executables.pdf
Size:
0.41 MB
Last modified:
2024/10/15
2023-02-24 - Lord Of The Ring0 - Part 4 The call back home.pdf
Size:
0.40 MB
Last modified:
2024/10/15
2023-02-14 - Adopting Position Independent Shellcodes from Object Files in Memory for Threadless Injection.pdf
Size:
0.96 MB
Last modified:
2024/10/15
2023-02-09 - Transitioning from User Mode to Kernel mode - Extravagant Prick.txt
Size:
0.01 MB
Last modified:
2024/10/15
2023-02-07 - Home Grown Red Team - Lets Make Some OneNote Phishing Attachments.pdf
Size:
1.44 MB
Last modified:
2024/10/15
2023-02-07 - Demonstrating Unhooking NTDLL from Suspended Process.7z
Size:
0.01 MB
Last modified:
2024/10/15
2023-02-07 - Demonstrating Unhooking NTDLL from Remote Server.7z
Size:
0.01 MB
Last modified:
2024/10/15
2023-02-07 - Demonstrating Unhooking NTDLL from KnownDlls.7z
Size:
0.01 MB
Last modified:
2024/10/15
2023-02-07 - Demonstrating Unhooking NTDLL from Disk.7z
Size:
0.00 MB
Last modified:
2024/10/15
2023-02-06 - Diving Deeper Into Pre-created Computer Accounts.pdf
Size:
1.97 MB
Last modified:
2024/10/15
2023-02-03 - Windows Domain Controller NTDSUTIL activate instance abuse.PNG
Size:
0.17 MB
Last modified:
2024/10/15
2023-02-01 - Weird things I learned while writing an x86 emulator.pdf
Size:
0.18 MB
Last modified:
2024/10/15
2023-01-31 - Lets Go VS Code - Using VS Code as a Reverse Shell.pdf
Size:
0.53 MB
Last modified:
2024/10/15
2023-01-30 - Shellcode Execution via MiniDumpWriteDump.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-30 - Abusing Exceptions for Code Execution Part 2.pdf
Size:
0.98 MB
Last modified:
2024/10/15
2023-01-29 - Shellcode Execution via waveOutOpen.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-29 - Shellcode Execution via SetupInstallFile.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-29 - Shellcode Execution via DnsServiceBrowse.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-29 - Shellcode Execution via DdeInitialize.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-29 - Shellcode Execution via CertEnumPhysicalStore.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-29 - Shellcode Execution via CertCreateContext.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-29 - Shellcode Execution via BindImageEx.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-29 - Indirect Syscall is Dead Long Live Custom Call Stacks.7z
Size:
0.94 MB
Last modified:
2024/10/15
2023-01-28 - Shellcode Execution via acmFormatTagEnum.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-28 - Shellcode Execution via WriteEncryptedFileRaw.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-28 - Shellcode Execution via DrawState.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-24 - Persistence via VSCode Profile Abuse.7z
Size:
0.10 MB
Last modified:
2024/10/15
2023-01-23 - Exfiltrating data using Powershell and WAV files.7z
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-21 - Shellcode Execution via WscRegisterForChanges.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-21 - Shellcode Execution via NPAddConnection3.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-20 - Shellcode Execution via RoInspectThreadErrorInfo.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-20 - Shellcode Execution via RoInspectCapturedStackBackTrace.c
Size:
0.00 MB
Last modified:
2024/10/15
2023-01-11 - SelfDebug - A useless anti-debug trick by forcing a process to debug itself.pdf
Size:
0.27 MB
Last modified:
2024/10/16
2023-01-04 - Investigating Filter Communication Ports.pdf
Size:
1.04 MB
Last modified:
2024/10/15
2022-12-30 - Code Execution against Windows HVCI.pdf
Size:
0.66 MB
Last modified:
2024/10/15
2022-12-29 - Bootkitting Windows Sandbox.pdf
Size:
0.30 MB
Last modified:
2024/10/15
2022-12-23 - Simple PE Loader.7z
Size:
0.06 MB
Last modified:
2024/10/15
2022-12-23 - Ctrl Injection Collection.7z
Size:
0.54 MB
Last modified:
2024/10/15
2022-12-20 - Shellcode Execution via WriteEncryptedFileRaw.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-12-20 - Shellcode Execution via DnsStartMulticastQuery.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-12-19 - Shellcode Execution via SetupIterateCabinet.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-12-19 - Shellcode Execution via DirectDrawEnumerateExA.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-12-18 - Shellcode Execution via SHBrowseForFolder.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-12-18 - Shellcode Execution via GrayString.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-12-18 - Diving into Intel Killer bloatware part 1.pdf
Size:
1.37 MB
Last modified:
2024/10/15
2022-12-16 - Polyshell - Bash, Batch, and Powershell Polyglot.zip
Size:
0.03 MB
Last modified:
2024/10/15
2022-12-10 - StealthHook - A method for hooking a function without modifying memory protection.pdf
Size:
0.24 MB
Last modified:
2024/10/16
2022-12-08 - Hooking System Calls in Windows 11 22H2 like Avast Antivirus. Research, analysis and bypass.pdf
Size:
0.71 MB
Last modified:
2024/10/15
2022-12-07 - Programmatically Deleting Shadow Volumes - Xaoc.7z
Size:
0.01 MB
Last modified:
2024/10/15
2022-12-04 - SilentMoonWalk - Demonstrating call stack spoofing.zip
Size:
0.28 MB
Last modified:
2024/10/15
2022-11-23 - An End to KASLR Bypasses.pdf
Size:
0.32 MB
Last modified:
2024/10/15
2022-11-22 - x64 return address spoofing.7z
Size:
0.14 MB
Last modified:
2024/10/15
2022-11-19 - An Exercise in Dynamic Analysis.pdf
Size:
3.73 MB
Last modified:
2024/10/15
2022-11-16 - Bypassing AV-EDR Hooks via Vectored Syscall.pdf
Size:
1.53 MB
Last modified:
2024/10/15
2022-11-02 - IIS Pool Credential Dumping via undocumented command line arguments.7z
Size:
0.10 MB
Last modified:
2024/10/15
2022-10-31 - Resolving syscalls in CSharp.7z
Size:
0.02 MB
Last modified:
2024/10/15
2022-10-31 - Heavens Gate in CSharp.7z
Size:
0.01 MB
Last modified:
2024/10/15
2022-10-30 - Lord Of The Ring0 - Part 3 Sailing to the land of the user and debugging the ship.pdf
Size:
0.18 MB
Last modified:
2024/10/15
2022-10-28 - Using Windows IUIAutomation for spyware and other malicious purposes.html
Size:
0.01 MB
Last modified:
2024/10/15
2022-10-22 - WAM BAM - Recovering Web Tokens From Office.7z
Size:
3.13 MB
Last modified:
2024/10/15
2022-10-20 - SharedMemUtils - A simple tool to automatically find vulnerabilities in shared memory objects.pdf
Size:
0.45 MB
Last modified:
2024/10/16
2022-10-18 - Fantastic Rootkits And Where to Find Them Part 1.pdf
Size:
0.91 MB
Last modified:
2024/10/15
2022-10-18 - Changing memory protection using APC.pdf
Size:
0.18 MB
Last modified:
2024/10/15
2022-10-15 - Shellcode Execution via EnumCalendarInfo.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2022-10-13 - Random Number Generation using IOCTL.txt
Size:
0.00 MB
Last modified:
2024/10/15
2022-10-11 - Custom Keyboard Layout Persistence.zip
Size:
0.88 MB
Last modified:
2024/10/15
2022-10-11 - Abusing the Windows Power Management API.7z
Size:
0.15 MB
Last modified:
2024/10/15
2022-10-09 - Windows Server LDIF File Abuse for Silently Downloading Files.7z
Size:
0.27 MB
Last modified:
2024/10/15
2022-10-07 - Short term snapshot deletion via ExecuteScheduledSPPCreation.7z
Size:
0.21 MB
Last modified:
2024/10/15
2022-10-01 - Manual ICMP implementation using NtDeviceIoControlFile.txt
Size:
0.01 MB
Last modified:
2024/10/15
2022-09-28 - MS Help 2 Primer.pdf
Size:
0.26 MB
Last modified:
2024/10/15
2022-09-28 - Demonstrating the VirusTotal C2.zip
Size:
0.01 MB
Last modified:
2024/10/15
2022-09-27 - Constrained Language Mode Bypass When __PSLockDownPolicy Is Used.pdf
Size:
0.91 MB
Last modified:
2024/10/15
2022-09-26 - Sacrificing Suspended Processes.7z
Size:
2.17 MB
Last modified:
2024/10/15
2022-09-23 - Shellcode Execution via FCICreate.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-21 - Shellcode Execution via WindowsInspectString.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-21 - Shellcode Execution via WinBioVerifyWithCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-21 - Shellcode Execution via WinBioEnrollCaptureWithCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-21 - Shellcode Execution via WinBioCaptureSampleWithCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-21 - Shellcode Execution via NotifyNetworkConnectivityHintChange.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-21 - Shellcode Execution via MI_Session_Invoke.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-21 - Shellcode Execution via MI_Session_Close.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-20 - Shellcode Execution via PowerRegisterForEffectivePowerModeNotifications.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-20 - Shellcode Execution via ClusWorkerCreate.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-20 - Shellcode Execution via CertFindChainInStore.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-19 - Shellcode Execution via PdhBrowseCounters.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-18 - Shellcode Execution via acmFilterChoose.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-18 - Shellcode Execution via acmDriverEnum.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-18 - Shellcode Execution via RegisterWaitChainCOMCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-18 - Shellcode Execution via NotifyRouteChange2.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-18 - Shellcode Execution via LineDDA.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-18 - Shellcode Execution via ChooseColor.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-16 - Dissecting Windows Section Objects.pdf
Size:
1.35 MB
Last modified:
2024/10/15
2022-09-15 - Shellcode Execution via TrySubmitThreadpoolCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-15 - Shellcode Execution via ChooseFont.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-14 - Myths About External C2.pdf
Size:
0.73 MB
Last modified:
2024/10/15
2022-09-14 - Abusing Notepad Plugins for Evasion and Persistence.pdf
Size:
1.16 MB
Last modified:
2024/10/15
2022-09-13 - Shellcode Execution via PageSetupDlg.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-12 - Shellcode Execution via ReplaceText.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-12 - Shellcode Execution via PrintDlg.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-12 - Shellcode Execution via OleUIBusy.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-12 - Shellcode Execution via FindText.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-11 - Shellcode Execution via GetSaveFileName.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-11 - Shellcode Execution via GetOpenFileName.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-11 - Shellcode Execution via CreateThreadPoolWork.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-11 - Shellcode Execution via CreateThreadPoolTimer.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-10 - Shellcode Execution via InternetSetStatusCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-09 - WriteProcessMemoryAPC - Write memory to a remote process using APC calls.pdf
Size:
0.10 MB
Last modified:
2024/10/16
2022-09-05 - Shellcode Execution via WinHttpSetStatus.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via TaskDialogIndirect.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via SymRegisterCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via StackWalk.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via SetWaitableTimer.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via SHCreateThreadWithHandle.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via RegisterWaitForSingleObject.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via PerfStartProviderEx.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via NotifyUnicastIpAddressChange.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via NotifyTeredoPortChange.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via NotifyIpInterfaceChange.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via MessageBoxIndirect.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via MagSetWindowTransform.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via MFAddPeriodicCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via EvtSubscribe_CVEEventWrite.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via EncryptedFileRaw.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via DSA_EnumCallback.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via CopyFileTransacted.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Shellcode Execution via CDefFolderMenu_Create2.c
Size:
0.00 MB
Last modified:
2024/10/15
2022-09-05 - Inside the Windows Cache Manager.pdf
Size:
0.67 MB
Last modified:
2024/10/15
2022-09-05 - DirectX and HyperV - An Offensive View.pdf
Size:
9.55 MB
Last modified:
2024/10/15
2022-08-29 - DLL Sideloading ShellChromeAPI.PNG
Size:
0.07 MB
Last modified:
2024/10/15
2022-08-19 - Warbird Hook - Demonstrating shellcode injection and application hijacking.7z
Size:
0.02 MB
Last modified:
2024/10/15
2022-08-19 - Bypassing AppLocker by abusing HashInfo.pdf
Size:
0.94 MB
Last modified:
2024/10/15
2022-08-16 - Understanding a New Mitigation Module Tampering Protection.pdf
Size:
1.93 MB
Last modified:
2024/10/15
2022-08-16 - Demonstrating inline function importing in Cplusplus.zip
Size:
0.01 MB
Last modified:
2024/10/15
2022-08-08 - Manual Implementation of BlockDLLs and ACG.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2022-08-08 - Backdooring Office Structures Part 2 Payload Crumbs In Custom Parts.pdf
Size:
0.54 MB
Last modified:
2024/10/15
2022-08-07 - Tampering With Windows Syscalls.zip
Size:
0.03 MB
Last modified:
2024/10/15
2022-08-05 - Exploring the Windows Search Application Cache.zip
Size:
0.01 MB
Last modified:
2024/10/15
2022-08-05 - Backdooring Office Structures Part 1 The Oldschool.pdf
Size:
0.89 MB
Last modified:
2024/10/15
2022-08-04 - Lord Of The Ring0 - Part 2 A tale of routines IOCTLs and IRPs.pdf
Size:
0.36 MB
Last modified:
2024/10/15
2022-08-04 - API Resolving Obfuscation via Veh.zip
Size:
0.01 MB
Last modified:
2024/10/15
2022-08-02 - Inside Windows Defender System Guard Runtime Monitor.pdf
Size:
0.42 MB
Last modified:
2024/10/15
2022-08-02 - Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service LSASS.pdf
Size:
0.54 MB
Last modified:
2024/10/15
2022-08-01 - DeathSleep - Demonstrating sleep obfuscation.7z
Size:
0.64 MB
Last modified:
2024/10/15
2022-08-01 - DLL Hijacking Windows Defender NisSrv.txt
Size:
0.00 MB
Last modified:
2024/10/15
2022-07-29 - Running Exploit As Protected Process Light From Userland.pdf
Size:
0.23 MB
Last modified:
2024/10/15
2022-07-26 - Understanding DISM - Servicing Stack Interaction.pdf
Size:
0.22 MB
Last modified:
2024/10/15
2022-07-19 - Creating Processes Using System Calls.7z
Size:
0.31 MB
Last modified:
2024/10/15
2022-07-17 - 30 second execution persistence with Winlogon.PNG
Size:
0.23 MB
Last modified:
2024/10/15
2022-07-16 - Process Injection using QueueUserAPC Technique in Windows.pdf
Size:
0.62 MB
Last modified:
2024/10/15
2022-07-14 - Lord Of The Ring0 - Part 1 Introduction.pdf
Size:
0.16 MB
Last modified:
2024/10/15
2022-07-13 - Bluffy the AV Slayer.pdf
Size:
0.79 MB
Last modified:
2024/10/15
2022-07-05 - WMI Internals Part 1 - Understanding the Basics.pdf
Size:
1.02 MB
Last modified:
2024/10/15
2022-07-05 - Vulpes - Obfuscating Memory Regions with Timers.pdf
Size:
0.34 MB
Last modified:
2024/10/15
2022-07-05 - One I_O Ring to Rule Them All_ A Full Read_Write Exploit Primitive on Windows 11.pdf
Size:
0.49 MB
Last modified:
2024/10/15
2022-06-30 - Spoofing Call Stacks To Confuse EDRs.pdf
Size:
2.23 MB
Last modified:
2024/10/15
2022-06-30 - CallStack Spoofer Demonstration.zip
Size:
0.02 MB
Last modified:
2024/10/15
2022-06-28 - Weaponizing and Abusing Hidden Functionalities Contained in Office Document Properties.pdf
Size:
0.43 MB
Last modified:
2024/10/15
2022-06-28 - The hidden side of Seclogon part 3 - Racing for LSASS dumps.pdf
Size:
0.91 MB
Last modified:
2024/10/15
2022-06-26 - Protecting the Heap - Encryption and Hooks.pdf
Size:
0.42 MB
Last modified:
2024/10/15
2022-06-25 - PE Resource section for Process Injection.zip
Size:
0.01 MB
Last modified:
2024/10/15
2022-06-22 - Extracting Whitelisted Paths from Windows Defender ASR Rules.pdf
Size:
0.91 MB
Last modified:
2024/10/15
2022-06-21 - WebView2 Cookie Stealer Demonstration.zip
Size:
20.73 MB
Last modified:
2024/10/15
2022-06-17 - Sleep Obfuscation - Ekko.zip
Size:
0.00 MB
Last modified:
2024/10/15
2022-06-17 - Demonstrating Thread Stack Spoofing.zip
Size:
0.23 MB
Last modified:
2024/10/15
2022-06-14 - Demonstrating inline syscalls in Cplusplus.zip
Size:
0.01 MB
Last modified:
2024/10/15
2022-06-08 - Inside Get-AuthenticodeSignature.pdf
Size:
1.33 MB
Last modified:
2024/10/15
2022-05-31 - Crashing Windows by Abusing NtRaiseHardError.PNG
Size:
0.16 MB
Last modified:
2024/10/15
2022-05-27 - Nls Code Injection Through The Registry.zip
Size:
0.07 MB
Last modified:
2024/10/15
2022-05-24 - Gargoyle x64 - DeepSleep.zip
Size:
0.17 MB
Last modified:
2024/10/15
2022-05-16 - Demonstrating Reflective DLL Loading - KaynLdr.zip
Size:
0.11 MB
Last modified:
2024/10/15
2022-05-14 - About XLL Phishing.zip
Size:
3.17 MB
Last modified:
2024/10/15
2022-05-10 - Making NtCreateUserProcess Work.pdf
Size:
0.38 MB
Last modified:
2024/10/15
2022-05-09 - Spawning IE on Windows 11.PNG
Size:
0.09 MB
Last modified:
2024/10/15
2022-05-08 - Demonstrating Process Injection in Rust - Rusty Memory LoadLibrary.zip
Size:
0.02 MB
Last modified:
2024/10/15
2022-05-05 - Studying Next Generation Malware - NightHawks Attempt At Obfuscate and Sleep.pdf
Size:
0.10 MB
Last modified:
2024/10/15
2022-05-05 - Process Injection via Component Object Model (COM) IRundown-DoCallback().pdf
Size:
1.58 MB
Last modified:
2024/10/15
2022-05-05 - A very simple and alternative PID finder.pdf
Size:
0.21 MB
Last modified:
2024/10/15
2022-05-02 - g_CiOptions in a Virtualized World.pdf
Size:
0.56 MB
Last modified:
2024/10/15
2022-05-01 - Ipv4Fuscation Demonstration.7z
Size:
0.00 MB
Last modified:
2024/10/15
2022-05-01 - GetRawInputData Keylogger Demonstration.7z
Size:
0.00 MB
Last modified:
2024/10/15
2022-04-30 - Programmatically Hiding Windows Snapshots.7z
Size:
0.25 MB
Last modified:
2024/10/15
2022-04-29 - One Year to IO Ring What Changed.pdf
Size:
1.88 MB
Last modified:
2024/10/15
2022-04-27 - Alternate Method Of Contacting IPV4.PNG
Size:
0.03 MB
Last modified:
2024/10/15
2022-04-23 - Bypassing PESieve and Moneta The easy way.pdf
Size:
1.68 MB
Last modified:
2024/10/15
2022-04-22 - Bypassing LSA Protection in Userland.pdf
Size:
0.64 MB
Last modified:
2024/10/15
2022-04-19 - Resolving System Service Numbers using the Exception Directory.pdf
Size:
0.11 MB
Last modified:
2024/10/15
2022-04-19 - HyperGuard Part 3 More SKPG Extents.pdf
Size:
1.09 MB
Last modified:
2024/10/15
2022-04-19 - Dumping passwords using KRShowKeyMgr.PNG
Size:
0.18 MB
Last modified:
2024/10/15
2022-04-18 - UACMe.zip
Size:
0.37 MB
Last modified:
2024/10/15
2022-04-18 - Token Manipulation in Rust Demonation.zip
Size:
0.00 MB
Last modified:
2024/10/15
2022-04-18 - Implementing Global Injection and Hooking in Windows.pdf
Size:
0.46 MB
Last modified:
2024/10/15
2022-04-18 - A blueprint for evading industry leading endpoint protection in 2022.pdf
Size:
3.32 MB
Last modified:
2024/10/15
2022-04-15 - Make phishing great again VSTO office files are the new macro nightmare.pdf
Size:
3.03 MB
Last modified:
2024/10/15
2022-04-11 - Demonstrating Copying Data To A GPU - GpuMemoryAbuse.cpp
Size:
0.01 MB
Last modified:
2024/10/15
2022-04-09 - Demonstrating API Hooking in Rust.rar
Size:
1.85 MB
Last modified:
2024/10/15
2022-04-04 - Sharing is Caring - Abusing Shared Sections for Code Injection.pdf
Size:
0.23 MB
Last modified:
2024/10/15
2022-04-04 - AtlasC2 - Demonstrating A C2 in CSharp.zip
Size:
0.08 MB
Last modified:
2024/10/15
2022-04-03 - NtdllPipe - Using cmd.exe to retrieve a clean version of ntdll.dll.pdf
Size:
0.11 MB
Last modified:
2024/10/15
2022-04-03 - FveApiDLL Abuse Demonstration.7z
Size:
0.28 MB
Last modified:
2024/10/15
2022-04-02 - Unmanaged Code Execution with .NET Dynamic PInvoke.pdf
Size:
0.83 MB
Last modified:
2024/10/15
2022-04-02 - AudioTransmit - Transmitting data between computers using audio.pdf
Size:
0.28 MB
Last modified:
2024/10/16
2022-03-30 - EventPipe - An IPC method to transfer binary data between processes using event objects.pdf
Size:
0.17 MB
Last modified:
2024/10/16
2022-03-26 - Digging into PssCaptureSnapshot for LSASS Dumping.pdf
Size:
0.34 MB
Last modified:
2024/10/15
2022-03-24 - Manipulating LastWriteTime without leaving traces in the NTFS USN Journal.pdf
Size:
0.10 MB
Last modified:
2024/10/15
2022-03-17 - Process-Hollowing Example.7z
Size:
0.22 MB
Last modified:
2024/10/15
2022-03-17 - Process Overwriting - yet another variant.zip
Size:
0.07 MB
Last modified:
2024/10/15
2022-03-14 - Reversing Common Obfuscation Techniques.pdf
Size:
0.40 MB
Last modified:
2024/10/15
2022-03-11 - AV and EDR Evasion Using Direct System Calls.pdf
Size:
1.01 MB
Last modified:
2024/10/15
2022-02-25 - LogNT32 - Part 2 - Return-address hijacking implemented to improve efficiency.pdf
Size:
0.21 MB
Last modified:
2024/10/15
2022-02-17 - The magic behind wlrmdrexe.pdf
Size:
0.17 MB
Last modified:
2024/10/15
2022-02-17 - HyperGuard Secure Kernel Patch Guard Part 2 SKPG Extents.pdf
Size:
0.84 MB
Last modified:
2024/10/15
2022-02-16 - wlrmdr.exe LOLBIN.7z
Size:
0.15 MB
Last modified:
2024/10/15
2022-02-16 - Exploring Token Members Part 2.pdf
Size:
0.22 MB
Last modified:
2024/10/15
2022-02-14 - Abusing Exceptions for Code Execution Part 1.pdf
Size:
0.20 MB
Last modified:
2024/10/15
2022-02-10 - WindowsNoExec - Abusing existing instructions to executing arbitrary code without allocating executable memory.pdf
Size:
0.32 MB
Last modified:
2024/10/16
2022-02-09 - Hooks-On Hoot-Off Vitaminizing MiniDump.pdf
Size:
0.56 MB
Last modified:
2024/10/15
2022-02-08 - StackScraper - Capturing sensitive data using real-time stack scanning against a remote.pdf
Size:
0.33 MB
Last modified:
2024/10/16
2022-02-07 - Invisible Sandbox Evasion - Check Point Research.pdf
Size:
0.21 MB
Last modified:
2024/10/15
2022-02-06 - HijackFileHandle - Hijack a file in a remote process without code injection.pdf
Size:
0.22 MB
Last modified:
2024/10/16
2022-02-04 - KCTHIJACK - KernelCallbackTable Hijack.zip
Size:
2.88 MB
Last modified:
2024/10/15
2022-02-04 - JmpNoCall.pdf
Size:
1.15 MB
Last modified:
2024/10/15
2022-02-04 - EmbedExeLnk - Embedding an EXE inside a LNK with automatic execution.pdf
Size:
0.24 MB
Last modified:
2024/10/16
2022-02-04 - CreateSvcRpc - A custom RPC client to execute programs as the SYSTEM user.pdf
Size:
0.34 MB
Last modified:
2024/10/16
2022-02-04 - CallRemoteAPI - Call functions in remote processes.pdf
Size:
0.26 MB
Last modified:
2024/10/16
2022-02-04 - AppLocker bypass by hash caching misuse.pdf
Size:
0.15 MB
Last modified:
2024/10/15
2022-02-02 - Reading and writing remote process data without using ReadProcessMemory ⁄WriteProcessMemory.pdf
Size:
0.15 MB
Last modified:
2024/10/16
2022-02-01 - System-wide anti-debug technique using NtQuerySystemInformation and DuplicateHandle.pdf
Size:
0.18 MB
Last modified:
2024/10/16
2022-01-31 - Abusing the MS Office protocol scheme.pdf
Size:
1.91 MB
Last modified:
2024/10/15
2022-01-30 - SetTcpEntry6 - A custom SetTcpEntry implementation for IPv6.pdf
Size:
0.10 MB
Last modified:
2024/10/16
2022-01-30 - Retrieving the current EIP in C⁄C++.pdf
Size:
0.09 MB
Last modified:
2024/10/16
2022-01-28 - The good the bad and the stomped function.7z
Size:
0.70 MB
Last modified:
2024/10/15
2022-01-26 - Using SecureString to protect Malware.pdf
Size:
0.29 MB
Last modified:
2024/10/15
2022-01-23 - Understanding Windows Structured Exception Handling Part 4 – Pseudo __try and __except.pdf
Size:
0.16 MB
Last modified:
2024/10/15
2022-01-23 - Reload Executable Files to Achieve Efficient Inline-Hook.pdf
Size:
0.12 MB
Last modified:
2024/10/15
2022-01-23 - Persistence via P2P_PEER_DIST_API LoadPeerDist.pdf
Size:
0.07 MB
Last modified:
2024/10/15
2022-01-22 - WinINET InternetErrorDlgEx Registry Lookup persistence.pdf
Size:
0.18 MB
Last modified:
2024/10/15
2022-01-22 - Understanding Windows Structured Exception Handling Part 3 – Under The Hood.pdf
Size:
0.46 MB
Last modified:
2024/10/15
2022-01-18 - O365 HKCU WwlibDll Sideloading.pdf
Size:
0.15 MB
Last modified:
2024/10/15
2022-01-16 - Understanding Windows Structured Exception Handling Part 2 – Digging Deeper.pdf
Size:
0.25 MB
Last modified:
2024/10/15
2022-01-16 - Oobe Setup ErrorHandle.cmd Hijack.pdf
Size:
0.07 MB
Last modified:
2024/10/15
2022-01-16 - Notes on Windows MS-CXH and MS-CXH-FULL handlers.pdf
Size:
0.11 MB
Last modified:
2024/10/15
2022-01-15 - UserApcInject Example.7z
Size:
0.00 MB
Last modified:
2024/10/15
2022-01-15 - The ExtraWindowInject Process Injection Technique.7z
Size:
0.02 MB
Last modified:
2024/10/15
2022-01-15 - Stealing Process Tokens POC.7z
Size:
0.08 MB
Last modified:
2024/10/15
2022-01-15 - SetWindowsHookExInjection Example.7z
Size:
0.00 MB
Last modified:
2024/10/15
2022-01-15 - SetThreadContextInjection Example.7z
Size:
0.01 MB
Last modified:
2024/10/15
2022-01-15 - ReflectiveDLLInjection Example.7z
Size:
0.01 MB
Last modified:
2024/10/15
2022-01-15 - Programmatically Stopping Windows Defender.7z
Size:
0.15 MB
Last modified:
2024/10/15
2022-01-15 - Process HerpaDerping.7z
Size:
0.29 MB
Last modified:
2024/10/15
2022-01-15 - Process Doppelgänging POC.7z
Size:
0.13 MB
Last modified:
2024/10/15
2022-01-15 - Modifying the EPROCESS structure.7z
Size:
0.01 MB
Last modified:
2024/10/15
2022-01-15 - Demonstrating EAT hooking from Kernel space.7z
Size:
0.10 MB
Last modified:
2024/10/15
2022-01-15 - Demonstrating ATOM Bombing.7z
Size:
0.01 MB
Last modified:
2024/10/15
2022-01-15 - CreateRemoteThread Process Injection.7z
Size:
0.01 MB
Last modified:
2024/10/15
2022-01-12 - Red Canary - Antimalware Scan Interface (AMSI).pdf
Size:
0.20 MB
Last modified:
2024/10/15
2022-01-12 - Playing Around COM Objects Part 1 - DllGetClassObject and ShellExecute IDispatch for Process creation.pdf
Size:
2.02 MB
Last modified:
2024/10/15
2022-01-11 - Signed Kernal Drivers - Unguarded Gateway to Windows Core.pdf
Size:
1.40 MB
Last modified:
2024/10/15
2022-01-09 - Understanding Windows Structured Exception Handling Part 1 – The Basics.pdf
Size:
0.34 MB
Last modified:
2024/10/15
2022-01-04 - Exploring Token Members Part 1.pdf
Size:
0.66 MB
Last modified:
2024/10/15
2022-01-03 - NTSockets - Downloading a file via HTTP using the NtCreateFile.pdf
Size:
0.32 MB
Last modified:
2024/10/15
2022-01-01 - HyperGuard Secure Kernel Patch Guard Part 1 SKPG Initialization.pdf
Size:
1.40 MB
Last modified:
2024/10/15
2021-12-14 - COM Hijacking for Persistence.pdf
Size:
0.74 MB
Last modified:
2024/10/15
2021-12-09 - Create Microsoft-Signed Phishing Documents.pdf
Size:
0.24 MB
Last modified:
2024/10/15
2021-12-07 - Weaponizing Windows Virtualization.7z
Size:
0.21 MB
Last modified:
2024/10/15
2021-12-07 - The hidden side of Seclogon part 2 - Abusing leaked handles to dump LSASS memory.pdf
Size:
0.99 MB
Last modified:
2024/10/15
2021-12-07 - Programmatically Modifying Boot Configurations - BCDEdit.7z
Size:
0.01 MB
Last modified:
2024/10/15
2021-12-07 - Identifying Antivirus Software by enumerating Minifilter String Names.7z
Size:
0.15 MB
Last modified:
2024/10/15
2021-12-07 - Dynamically Retrieving SYSCALLs - Hells Gate.7z
Size:
0.36 MB
Last modified:
2024/10/15
2021-12-07 - Demonstrating USB Propagation.7z
Size:
0.26 MB
Last modified:
2024/10/15
2021-12-05 - Shellcode Execution via EnumThreadWindows.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-12-01 - Writing a simple 16 bit VM in less than 125 lines of C.pdf
Size:
1.32 MB
Last modified:
2024/10/15
2021-11-26 - Abusing Windows’ Implementation of Fork() for Stealthy Memory Operations.pdf
Size:
0.51 MB
Last modified:
2024/10/15
2021-11-18 - Persistence via Recycle Bin.7z
Size:
0.15 MB
Last modified:
2024/10/15
2021-11-15 - Design issues of modern EDRs bypassing ETW-based solutions.pdf
Size:
10.21 MB
Last modified:
2024/10/15
2021-11-10 - The DLL Search Order And Hijacking It.pdf
Size:
0.45 MB
Last modified:
2024/10/15
2021-10-28 - Malicious ZIP Demonstration.zip
Size:
0.01 MB
Last modified:
2024/10/15
2021-10-25 - C3 - Demonstrating C2s from MatterMost - GitHub - OneDrive and more.zip
Size:
32.10 MB
Last modified:
2024/10/15
2021-10-23 - Shellcode Execution via EnumCalendarInfoEx.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-10-23 - From AMSI to Reflection 0x0.pdf
Size:
6.11 MB
Last modified:
2024/10/15
2021-10-21 - Windows Exploitation Tricks - Relaying DCOM Authentication.pdf
Size:
0.58 MB
Last modified:
2024/11/13
2021-10-21 - Life is Pane - Persistence via Preview Handlers.pdf
Size:
0.56 MB
Last modified:
2024/10/15
2021-10-10 - SeManageVolumePrivilege Abuse with FSCTL_SD_GLOBAL_CHANGE.zip
Size:
0.00 MB
Last modified:
2024/10/15
2021-10-09 - Trololololobin and other lolololocoasters.pdf
Size:
0.08 MB
Last modified:
2024/10/15
2021-10-09 - IoRing vs io_uring a comparison of Windows and Linux implementations.pdf
Size:
0.12 MB
Last modified:
2024/10/15
2021-09-30 - Azure Outlook C2.zip
Size:
13.47 MB
Last modified:
2024/10/15
2021-08-23 - Another AMSI-Bypass paper.pdf
Size:
1.63 MB
Last modified:
2024/10/15
2021-08-05 - Evil Model - Hiding Malware.pdf
Size:
0.73 MB
Last modified:
2024/10/15
2021-08-03 - Reading, Writing, and Executing A File WITHOUT A File Path - yarhLoader.c
Size:
0.04 MB
Last modified:
2024/10/15
2021-07-26 - Shellcoding - Process Injection with Assembly.pdf
Size:
1.16 MB
Last modified:
2024/10/15
2021-07-23 - Modifying MS Office security warnings.PNG
Size:
0.04 MB
Last modified:
2024/10/15
2021-06-28 - Stealing Tokens In Kernel Mode With A Malicious Driver.pdf
Size:
0.33 MB
Last modified:
2024/10/15
2021-06-20 - Demonstrating How to Dump Chrome Passwords.7z
Size:
0.98 MB
Last modified:
2024/10/15
2021-06-19 - Backstab - Demonstrating how to kill EDR protected processes.zip
Size:
0.05 MB
Last modified:
2024/10/15
2021-06-18 - Knock Knock The postman is here (abusing Mailslots and PortKnocking for connectionless shells).pdf
Size:
0.45 MB
Last modified:
2024/10/15
2021-06-12 - Shellcode Execution via EnumICMProfiles.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-05-24 - IO Rings When One IO Operation is Not Enough.pdf
Size:
0.72 MB
Last modified:
2024/10/15
2021-05-23 - Preventing memory inspection on Windows.pdf
Size:
0.16 MB
Last modified:
2024/10/15
2021-05-21 - Dumping Stored Credentials with SeTrustedCredmanAccessPrivilege.pdf
Size:
0.19 MB
Last modified:
2024/10/15
2021-05-13 - Reshaping Shadow Volumes with IOCTLs.txt
Size:
0.00 MB
Last modified:
2024/10/15
2021-05-12 - Breaking the WDAPT Rules with COM.pdf
Size:
2.76 MB
Last modified:
2024/10/15
2021-05-07 - Shellcode Execution via EnumTimeFormatsEx.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-05-06 - Shellcode Execution via CryptEnumOIDInfo.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-05-05 - Weird Ways to Run Unmanaged Code in NET.pdf
Size:
2.63 MB
Last modified:
2024/10/15
2021-05-03 - Shellcode Execution via EnumObjects.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-05-01 - Symantec Endpoint Protection Meets COM - Using Symantec.SSHelper As A LOLBIN.pdf
Size:
0.47 MB
Last modified:
2024/10/15
2021-05-01 - Shellcode Execution via EnumFontFamiliesExW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-30 - Shellcode Execution via EnumFontFamiliesW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-28 - Shellcode Execution via EnumFontsW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-22 - Binary Data Hiding in VB6 Executables.pdf
Size:
0.41 MB
Last modified:
2024/10/15
2021-04-20 - Thread and Process State Change.pdf
Size:
0.29 MB
Last modified:
2024/10/15
2021-04-15 - Shellcode Execution via ImmEnumInputContext.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-12 - Shellcode Execution via EnumResourceTypesExW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-11 - Shellcode Execution via EnumPwrSchemes.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-09 - Shellcode Execution via EnumSystemLocales.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-08 - Shellcode Execution via EnumUILanguagesW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-08 - Process Code Injection Through Undocumented NTAPI.pdf
Size:
0.50 MB
Last modified:
2024/10/15
2021-04-04 - Shellcode Execution via SetupCommitFileQueueW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-04-01 - Shellcode Execution via SetTimer.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-31 - Shellcode Execution via EnumLanguageGroupLocalesW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-30 - Shellcode Execution via LdrpCallInitRoutine.vcxproj
Size:
0.01 MB
Last modified:
2024/10/15
2021-03-30 - Shellcode Execution via LdrEnumerateLoadedModules.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-30 - KeDll Injector.rar
Size:
0.02 MB
Last modified:
2024/10/15
2021-03-28 - Shellcode Execution via RtlUserFiberStart.vcxproj
Size:
0.01 MB
Last modified:
2024/10/15
2021-03-28 - Shellcode Execution via FlsAlloc.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-28 - Shellcode Execution via EnumPropsW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-28 - Executing a PE File in Memory.zip
Size:
18.62 MB
Last modified:
2024/10/15
2021-03-27 - Shellcode Execution via SymFindFileInPath.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-27 - Shellcode Execution via InitOnceExecuteOnce.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-27 - Shellcode Execution via FiberContextEdit.vcxproj
Size:
0.01 MB
Last modified:
2024/10/15
2021-03-25 - Demonstrating Keylogging Using NtUserGetRawInputDataKeylogger.cpp
Size:
0.04 MB
Last modified:
2024/10/15
2021-03-24 - Excel Macro Anti-Analysis Techniques.pdf
Size:
1.22 MB
Last modified:
2024/10/15
2021-03-21 - Shellcode Execution via SysEnumSourceFiles.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-19 - Shellcode Execution via EnumDirTreeW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-19 - Shellcode Execution via EnumDesktopW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-19 - Shellcode Execution via CreateThreadPoolWait.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-18 - Anti Debugging Protection Techniques with Examples.pdf
Size:
1.02 MB
Last modified:
2024/10/15
2021-03-14 - Shellcode Execution via CertEnumSystemStoreLocation.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-12 - Shellcode Execution via CertEnumSystemStore.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-11 - Shellcode Execution via VerifierEnumerateResource.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-11 - Exploiting a Simple Vulnerability Part 2 What If We Made Exploitation Harder.pdf
Size:
0.97 MB
Last modified:
2024/10/15
2021-03-10 - Exfiltrating Data from Outlook Demonstration.7z
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-08 - Shellcode Execution via ImageGetDigestStream.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-08 - Shellcode Execution via EnumerateLoadedModules.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-07 - Shellcode Execution via SymEnumProcesses.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-07 - Shellcode Execution via EnumWindowStationsW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-07 - Shellcode Execution via CopyFileEx.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-05 - Shellcode Execution via EnumPageFilesW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-05 - Persistence via Java Environment Variables.pdf
Size:
0.08 MB
Last modified:
2024/10/15
2021-03-03 - Shellcode Execution via EnumDesktopWindows.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-02 - Shellcode Execution via EnumPropsEx.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-02 - Shellcode Execution via EnumDisplayMonitors.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-01 - Shellcode Execution via EnumWindows.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-01 - Shellcode Execution via EnumResourceTypesW.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-01 - Shellcode Execution via EnumChildWindows.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-01 - Shellcode Execution via CreateTimerQueueTimer_Tech.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-01 - Shellcode Execution via CreateTimerQueueTimer.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-03-01 - Shellcode Execution via CopyFile2.cpp
Size:
0.00 MB
Last modified:
2024/10/15
2021-02-28 - PE Injection_ Executing PEs inside Remote Processes.pdf
Size:
0.67 MB
Last modified:
2024/10/15
2021-02-27 - Windows object permissions as a backdoor.pdf
Size:
0.79 MB
Last modified:
2024/11/13
2021-02-16 - LSASS Memory Dumps are Stealthier than Ever Before - Part 2.pdf
Size:
0.26 MB
Last modified:
2024/10/15
2021-02-13 - x64 Deep Dive.pdf
Size:
0.90 MB
Last modified:
2024/10/15
2021-02-12 - Offensive Windows IPC Internals 2 RPC.pdf
Size:
0.67 MB
Last modified:
2024/10/15
2021-02-06 - Microsoft Office HTML Editor for Persistence.pdf
Size:
0.11 MB
Last modified:
2024/10/15
2021-01-30 - Executing Position Independent Shellcode from Object Files in Memory.pdf
Size:
0.88 MB
Last modified:
2024/10/15
2021-01-24 - LSASS Memory Dumps are Stealthier than Ever Before - Part 1.pdf
Size:
0.47 MB
Last modified:
2024/10/15
2021-01-20 - Process on a diet anti-debug using job objects.pdf
Size:
0.09 MB
Last modified:
2024/10/15
2021-01-12 - tagSOleTlsData and the COM concurrency model for the current thread.pdf
Size:
0.60 MB
Last modified:
2024/10/15
2021-01-10 - Offensive Windows IPC Internals 1 Named Pipes.pdf
Size:
0.57 MB
Last modified:
2024/10/15
2021-01-09 - Heresys Gate Kernel ZwNTDLL Scraping and Work Out Ring 0 to Ring 3 via Worker Factories.pdf
Size:
0.43 MB
Last modified:
2024/10/15
2021-01-09 - CET Updates - Dynamic Address Ranges.pdf
Size:
0.19 MB
Last modified:
2024/10/15
2021-01-08 - Exploiting a Simple Vulnerability Part 15 The Info Leak.pdf
Size:
0.45 MB
Last modified:
2024/10/15
2020-12-31 - Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams.pdf
Size:
0.32 MB
Last modified:
2024/10/15
2020-12-31 - Antivirus Artifacts III.pdf
Size:
0.34 MB
Last modified:
2024/10/15
2020-12-24 - The worst of the two worlds - Excel meets Outlook.pdf
Size:
0.24 MB
Last modified:
2024/10/15
2020-11-29 - Weaponize GhostWriting Injection Code Injection Series Part 5.pdf
Size:
0.37 MB
Last modified:
2024/10/15
2020-11-23 - A Fresh Outlook on Mail Based Persistence.pdf
Size:
0.29 MB
Last modified:
2024/10/15
2020-11-21 - Exploiting a Simple Vulnerability In 35 Easy Steps or Less.pdf
Size:
2.22 MB
Last modified:
2024/10/15
2020-11-09 - WOW64Hooks WOW64 Subsystem Internals and Hooking Techniques.pdf
Size:
0.99 MB
Last modified:
2024/10/15
2020-11-09 - DPWs are the new DPCs Deferred Procedure Waits in Windows 10 21H1.pdf
Size:
1.07 MB
Last modified:
2024/10/15
2020-10-19 - SERVICE_FAILURE_ACTIONSW Exception for Persistence.pdf
Size:
0.06 MB
Last modified:
2024/10/15
2020-10-18 - Commandeering Context Menu Entries.7z
Size:
0.51 MB
Last modified:
2024/10/15
2020-10-17 - DllBidEntryPoint Abuse.pdf
Size:
0.07 MB
Last modified:
2024/10/15
2020-10-12 - I Like to Move It - Windows Lateral Movement Part 3 - DLL Hijacking.pdf
Size:
2.02 MB
Last modified:
2024/10/15
2020-10-11 - Masquerading the HKCU Run Key.7z
Size:
0.14 MB
Last modified:
2024/10/15
2020-10-11 - From a C project through assembly to shellcode.pdf
Size:
1.33 MB
Last modified:
2024/10/15
2020-10-10 - A Deep Dive Into RUNDLL32EXE.pdf
Size:
0.27 MB
Last modified:
2024/10/15
2020-10-08 - Cryogenically Frozen Malware.7z
Size:
0.31 MB
Last modified:
2024/10/15
2020-10-06 - CET Updates - CET on Xanax.pdf
Size:
0.24 MB
Last modified:
2024/10/15
2020-10-02 - Malware Persistence Mechanisms.pdf
Size:
0.84 MB
Last modified:
2024/10/15
2020-09-26 - Demystifying the SVCHOSTEXE Process and Its Command Line Options.pdf
Size:
0.34 MB
Last modified:
2024/10/15
2020-09-26 - Deep dive into user-mode Asynchronous Procedure Calls in Windows.pdf
Size:
0.70 MB
Last modified:
2024/10/15
2020-09-18 - More Windows 10 Phantom DLLs.pdf
Size:
0.06 MB
Last modified:
2024/10/15
2020-09-18 - Covert Data Persistence with Windows Registry Keys.pdf
Size:
0.11 MB
Last modified:
2024/10/15
2020-09-16 - Silent Runners - Exploring Persistence Methods.7z
Size:
0.10 MB
Last modified:
2024/10/15
2020-09-16 - Defeating Macro Document Static Analysis with Pictures of My Cat.pdf
Size:
0.90 MB
Last modified:
2024/10/15
2020-08-16 - QT Framework QT_DEBUG_PLUGINS Persistence.pdf
Size:
0.06 MB
Last modified:
2024/10/15
2020-08-05 - Checkpoint Research - Anti-Debug - Timing.pdf
Size:
0.26 MB
Last modified:
2024/10/15
2020-08-05 - Checkpoint Research - Anti-Debug - Process Memory.pdf
Size:
0.64 MB
Last modified:
2024/10/15
2020-08-05 - Checkpoint Research - Anti-Debug - Object Handles.pdf
Size:
0.30 MB
Last modified:
2024/10/15
2020-08-05 - Checkpoint Research - Anti-Debug - Misc.pdf
Size:
0.34 MB
Last modified:
2024/10/15
2020-08-05 - Checkpoint Research - Anti-Debug - Exceptions.pdf
Size:
0.20 MB
Last modified:
2024/10/15
2020-08-05 - Checkpoint Research - Anti-Debug - Direct debugger interaction.pdf
Size:
0.41 MB
Last modified:
2024/10/15
2020-08-05 - Checkpoint Research - Anti-Debug - Debug Flags.pdf
Size:
0.73 MB
Last modified:
2024/10/15
2020-08-05 - Checkpoint Research - Anti-Debug - Assembly instructions.pdf
Size:
0.33 MB
Last modified:
2024/10/15
2020-08-04 - Masking Malicious Memory Artifacts Part III - Bypassing Defensive Scanners.pdf
Size:
3.65 MB
Last modified:
2024/10/15
2020-08-03 - Critical Protected DUT Processes in Windows 10.pdf
Size:
0.46 MB
Last modified:
2024/10/15
2020-08-02 - Removing Kernel Callbacks Using Signed Drivers.7z
Size:
0.41 MB
Last modified:
2024/10/15
2020-07-30 - Terminal Server Utilities LOLBIN and Persistence.pdf
Size:
0.10 MB
Last modified:
2024/10/15
2020-07-16 - Weaponizing Mapping Injection With instrumentation Callback.pdf
Size:
0.69 MB
Last modified:
2024/10/15
2020-07-16 - Masking Malicious Memory Artifacts Part II - Blending in with False Positives.pdf
Size:
6.56 MB
Last modified:
2024/10/15
2020-07-12 - Secure Pool Internals Dynamic KDP Behind The Hood.pdf
Size:
1.27 MB
Last modified:
2024/10/15
2020-07-11 - Superfetch - Unknown Spy.pdf
Size:
1.45 MB
Last modified:
2024/10/15
2020-07-10 - Masking Malicious Memory Artifacts Part 1 – Phantom DLL Hollowing.pdf
Size:
0.59 MB
Last modified:
2024/10/15
2020-07-10 - Fs Minifilter Hooking Part 1.pdf
Size:
1.48 MB
Last modified:
2024/10/15
2020-07-03 - How to obfuscate strings using CPlusPlus constexpr Or how to do it correctly at compile time.txt
Size:
0.01 MB
Last modified:
2024/10/15
2020-06-28 - APC Series KiUserApcDispatcher and Wow64.pdf
Size:
0.33 MB
Last modified:
2024/10/15
2020-06-24 - Process Injection Techniques used by Malware.pdf
Size:
0.20 MB
Last modified:
2024/10/15
2020-06-20 - Hiding Process Memory via Anti-Forensic Techniques.pdf
Size:
0.46 MB
Last modified:
2024/10/15
2020-06-14 - Process Injection Techniques.pdf
Size:
0.61 MB
Last modified:
2024/10/15
2020-06-10 - Cmd Hijack - A Command_Argument Confustion with Path Traversal.pdf
Size:
2.16 MB
Last modified:
2024/10/15
2020-06-09 - Abusing Windows Telemetry for Persistence.pdf
Size:
0.19 MB
Last modified:
2024/10/15
2020-06-06 - NINA - x64 Process Injection.pdf
Size:
0.96 MB
Last modified:
2024/10/15
2020-06-03 - APC Series User APC Internals.pdf
Size:
0.58 MB
Last modified:
2024/10/15
2020-06-01 - Using Syscalls to Inject Shellcode on Windows.pdf
Size:
1.03 MB
Last modified:
2024/10/15
2020-05-28 - GetEnvironmentVariable As Alternative to WriteProccessMemory in Process Injections.pdf
Size:
0.13 MB
Last modified:
2024/10/15
2020-05-27 - Shellcode - Recycling Compression Algorithms for the Z80, 8088, 6502, 8086 and 68K Architectures.pdf
Size:
0.40 MB
Last modified:
2024/10/15
2020-05-18 - How to use Trend Micro's Rootkit Remover to Install a Rootkit.pdf
Size:
0.70 MB
Last modified:
2024/10/15
2020-05-17 - APC Series User APC API.pdf
Size:
0.33 MB
Last modified:
2024/10/15
2020-05-12 - PrintDemon Print Spooler Privilege Escalation Persistence amp Stealth CVE-2020-1048 amp more.pdf
Size:
1.21 MB
Last modified:
2024/10/15
2020-05-10 - The Fake Entry Point Trick.txt
Size:
0.00 MB
Last modified:
2024/10/15
2020-05-03 - Fax Service Bind shell abusing Ualapi.7z
Size:
0.01 MB
Last modified:
2024/10/15
2020-04-30 - Faxing Your Way to SYSTEM Part Two.pdf
Size:
1.53 MB
Last modified:
2024/10/15
2020-04-30 - Fax Shell - Using Fax service for system.7z
Size:
0.01 MB
Last modified:
2024/10/15
2020-04-24 - Windows DLL Hijacking Hopefully Clarified.pdf
Size:
0.72 MB
Last modified:
2024/10/15
2020-04-01 - Updating the Undocumented ESTROBJ and STROBJ Structures for Windows 10 x64.pdf
Size:
0.81 MB
Last modified:
2024/10/15
2020-03-24 - Symbolic Hooks Part 4 The App Container Traverse-ty.pdf
Size:
1.04 MB
Last modified:
2024/10/15
2020-03-19 - Symbolic Hooks Part 3 The Remainder Theorem.pdf
Size:
0.16 MB
Last modified:
2024/10/15
2020-03-18 - ShimBad the Sailor.pdf
Size:
0.09 MB
Last modified:
2024/10/15
2020-02-29 - Windows Kernel Ps Callbacks Experiments.pdf
Size:
2.59 MB
Last modified:
2024/10/15
2020-02-23 - A stealthier approach to spoofing process command line.pdf
Size:
0.27 MB
Last modified:
2024/10/15
2020-02-18 - Symbolic Hooks Part 2 Getting the Target Name.pdf
Size:
0.55 MB
Last modified:
2024/10/15
2020-02-18 - Move aside signature scanning Better kernel data discovery through lookaside lists.pdf
Size:
0.40 MB
Last modified:
2024/10/15
2020-02-10 - WDExtract - Extracting data from Windows Defender.zip
Size:
0.36 MB
Last modified:
2024/10/15
2020-02-10 - From Process Injection to Function Hijacking.pdf
Size:
0.43 MB
Last modified:
2024/10/15
2020-02-03 - Hooking Heavens Gate - a WOW64 hooking technique.pdf
Size:
0.55 MB
Last modified:
2024/10/15
2020-02-03 - Bypass EDRs memory protection - an introduction to hooking.pdf
Size:
1.25 MB
Last modified:
2024/10/15
2020-01-31 - DKOM - Now with Symbolic Links.pdf
Size:
0.67 MB
Last modified:
2024/10/15
2020-01-23 - Starting WERSVR from a restricted users.7z
Size:
0.48 MB
Last modified:
2024/10/15
2020-01-06 - NtCreateSection and NtMapViewOfSection for Code Injection.pdf
Size:
0.67 MB
Last modified:
2024/10/15
2020-01-05 - RIP ROP CET Internals in Windows 20H1.pdf
Size:
1.59 MB
Last modified:
2024/10/15
2020-01-02 - Exploiting Flaws in Windbg.pdf
Size:
0.99 MB
Last modified:
2024/10/15
2019-12-17 - Calling Local Windows RPC Servers from NET.pdf
Size:
0.42 MB
Last modified:
2024/11/13
2019-12-02 - Evading WinDefender ATP credential-theft a hit after a hit-and-miss start.pdf
Size:
0.45 MB
Last modified:
2024/10/15
2019-11-18 - Abusing Intel VTune Amplifier for Persistence.pdf
Size:
0.06 MB
Last modified:
2024/10/15
2019-11-11 - Antimalware Scan Interface AMSI.pdf
Size:
0.07 MB
Last modified:
2024/10/15
2019-11-06 - Bypassing Kernel Function Pointer Integrity Checks.pdf
Size:
0.20 MB
Last modified:
2024/10/15
2019-10-24 - SPReview Permanent Persistence.pdf
Size:
0.07 MB
Last modified:
2024/10/15
2019-10-23 - SPReview Phantom DLLs.pdf
Size:
0.06 MB
Last modified:
2024/10/15
2019-10-11 - An alternate way to execute a binary - NtQueryInformationProcess and the AeDebugProtected key.pdf
Size:
0.12 MB
Last modified:
2024/10/15
2019-09-20 - Exotic persistence - Windows Error Reporting Debugger key.pdf
Size:
0.06 MB
Last modified:
2024/10/15
2019-09-07 - AutoPlay Handlers for persistence.pdf
Size:
0.10 MB
Last modified:
2024/10/15
2019-08-23 - How the Antimalware Scan Interface AMSI helps you defend against malware.pdf
Size:
0.42 MB
Last modified:
2024/10/15
2019-08-22 - Common Language Runtime Hook for Persistence.pdf
Size:
2.59 MB
Last modified:
2024/10/15
2019-08-17 - Weaponizing Privileged File Writes with the USO Service.7z
Size:
1.07 MB
Last modified:
2024/10/15
2019-08-16 - IBM Java Control Panel for persistence.pdf
Size:
0.08 MB
Last modified:
2024/10/15
2019-08-13 - The state of advanced code injections.pdf
Size:
0.45 MB
Last modified:
2024/10/15
2019-08-12 - Windows Process Injection via KnownDlls Cache Poisoning.pdf
Size:
0.35 MB
Last modified:
2024/10/15
2019-08-08 - Process Injection Techniques - Gotta Catch Them All.pdf
Size:
0.72 MB
Last modified:
2024/10/15
2019-08-08 - Demonstating Various Process Injection Techniques - Pinjecta.zip
Size:
0.10 MB
Last modified:
2024/10/15
2019-07-21 - In-memory execution of VBScript, JavaScript or JScript.txt
Size:
0.01 MB
Last modified:
2024/10/15
2019-07-07 - Dumping LSASS - MiniDumpWriteDump to Memory using MiniDump Callbacks.txt
Size:
0.00 MB
Last modified:
2024/10/15
2019-07-07 - Calling Syscalls Directly from Visual Studio to Bypass AVs and EDRs.pdf
Size:
0.49 MB
Last modified:
2024/10/15
2019-07-03 - MiniDumpWriteDump and PssCaptureSnapshot.txt
Size:
0.00 MB
Last modified:
2024/10/15
2019-07-03 - Dumping LSASS - MiniDumpWriteDump to Disk.txt
Size:
0.00 MB
Last modified:
2024/10/15
2019-06-29 - Persistence with Windows Services.pdf
Size:
0.12 MB
Last modified:
2024/10/15
2019-06-19 - Combining Direct System Calls and sRDI.pdf
Size:
2.01 MB
Last modified:
2024/10/15
2019-06-03 - How Red Teams Bypass AMSI and WLDP for .NET Dynamic Code.pdf
Size:
0.31 MB
Last modified:
2024/10/15
2019-04-26 - Hunting for Ghosts in Fileless Attacks.pdf
Size:
4.34 MB
Last modified:
2024/10/15
2019-04-08 - Early Bird Injection - APC Abuse.pdf
Size:
0.87 MB
Last modified:
2024/10/15
2019-04-07 - Loading and calling VB from CPlusPlus.zip
Size:
0.01 MB
Last modified:
2024/10/15
2019-02-25 - Notes on RtlCloneUserProcess.7z
Size:
0.43 MB
Last modified:
2024/10/15
2019-02-15 - Understanding Windows x64 ASM.7z
Size:
2.00 MB
Last modified:
2024/10/15
2019-01-04 - A dive into the world of MS-DOS viruses.pdf
Size:
1.70 MB
Last modified:
2024/10/15
2018-12-12 - VBA RunPE - Breaking Out of Highly Constrained Desktop Environments.7z
Size:
0.29 MB
Last modified:
2024/10/15
2018-11-30 - Injecting Code into Windows Protected Processes using COM - Part 2.pdf
Size:
0.67 MB
Last modified:
2024/10/15
2018-11-01 - Process Injection Techniques and Detection using the Volatility Framework.pdf
Size:
5.64 MB
Last modified:
2024/10/15
2018-10-20 - Using DropBox As A C2.zip
Size:
0.43 MB
Last modified:
2024/10/15
2018-10-16 - Injecting Code into Windows Protected Processes using COM - Part 1.pdf
Size:
1.24 MB
Last modified:
2024/10/15
2018-09-09 - Finding Interactive User COM Objects using PowerShell.pdf
Size:
0.13 MB
Last modified:
2024/10/15
2018-09-06 - Persistence using Universal Windows Platform apps.pdf
Size:
0.37 MB
Last modified:
2024/10/15
2018-08-19 - NTFS Alternate Streams What, When, and How To.7z
Size:
0.23 MB
Last modified:
2024/10/15
2018-08-07 - Windows Exploitation Tricks Exploiting Arbitrary Object Directory Creation for Local Elevation of Pri.pdf
Size:
0.25 MB
Last modified:
2024/10/15
2018-06-18 - Exploring PowerShell AMSI and Logging Evasion.pdf
Size:
1.61 MB
Last modified:
2024/10/15
2018-06-14 - PE Injection Demonstration 2.zip
Size:
0.00 MB
Last modified:
2024/10/15
2018-03-26 - Ghostwrite Demonstration.c
Size:
0.05 MB
Last modified:
2024/10/15
2018-03-17 - Abusing Exported Functions and Exposed DCOM Interfaces.pdf
Size:
0.87 MB
Last modified:
2024/10/15
2017-10-15 - Understanding API Set Resolution.7z
Size:
0.54 MB
Last modified:
2024/10/15
2017-10-06 - An Introduction to Standard and Isolation Minifilters.pdf
Size:
0.33 MB
Last modified:
2024/10/15
2017-10-03 - Windows 10 Parallel Loading Breakdown.pdf
Size:
2.07 MB
Last modified:
2024/10/15
2017-09-19 - Abusing Delay Load DLLs for Remote Code Injection.pdf
Size:
0.20 MB
Last modified:
2024/10/15
2017-08-12 - Finding handle leaks - user mode duplicate handle in C and CSharp.zip
Size:
0.05 MB
Last modified:
2024/10/15
2017-06-07 - Process Hollowing with Manalyzes PE library.pdf
Size:
0.38 MB
Last modified:
2024/10/15
2016-11-21 - Keylogging using ETW in CSharp.NET.7z
Size:
3.29 MB
Last modified:
2024/10/15
2016-10-27 - AtomBombing - A Brand New Code Injection Technique for Windows.pdf
Size:
0.21 MB
Last modified:
2024/10/15
2016-05-19 - PE File Infection.pdf
Size:
0.22 MB
Last modified:
2024/10/15
2016-02-10 - The Definitive Guide on Win32 to NT Path Conversion.pdf
Size:
0.91 MB
Last modified:
2024/10/15
2016-01-12 - Creating Processes By Using Undocumented COM APIs.7z
Size:
0.00 MB
Last modified:
2024/10/15
2015-12-05 - Abusing WMI To Build A Persistent Asynchronous And Fileless Backdoor.pdf
Size:
0.97 MB
Last modified:
2024/11/13
2015-08-20 - Manually Enumerating Process Modules.pdf
Size:
0.22 MB
Last modified:
2024/11/13
2015-08-12 - Stealth Techniques - Hiding Files in the Registry.pdf
Size:
0.34 MB
Last modified:
2024/11/13
2015-08-10 - Windows 10HH Symbolic Link Mitigations.pdf
Size:
0.38 MB
Last modified:
2024/10/15
2015-04-06 - Hiding loaded driver with DKOM.txt
Size:
0.00 MB
Last modified:
2024/10/15
2015-03-30 - Another detailed guide to PE infection.txt
Size:
0.02 MB
Last modified:
2024/10/15
2015-03-06 - PE Infection - Add a PE section - with code.txt
Size:
0.01 MB
Last modified:
2024/10/15
2014-12-03 - Hooking COM Objects - Intercepting Calls to COM Interfaces.7z
Size:
0.38 MB
Last modified:
2024/10/15
2014-04-13 - PE Injection Explained Advanced memory code injection technique.pdf
Size:
0.30 MB
Last modified:
2024/10/15
2014-02-06 - Hide process with DKOM without hard coded offsets.txt
Size:
0.01 MB
Last modified:
2024/10/15
2014-02-03 - PE Injection Demonstration 1.zip
Size:
0.00 MB
Last modified:
2024/10/15
2012-11-01 - SizeOfStackReserve As Anti-Attaching Trick.pdf
Size:
0.53 MB
Last modified:
2024/10/15
2012-09-19 - Knockin on Heavens Gate - Dynamic Processor Mode Switching.pdf
Size:
0.47 MB
Last modified:
2024/10/15
2012-03-21 - Using UPX as a Security Packer.pdf
Size:
1.95 MB
Last modified:
2024/10/15
2012-02-14 - Stack Necromancy - Defeating Debuggers By Raising the Dead.pdf
Size:
0.17 MB
Last modified:
2024/10/15
2011-06-29 - Implementing keyloggers in Windows.pdf
Size:
0.59 MB
Last modified:
2024/10/15
2011-05-04 - The Ultimate Anti-Debugging Reference.pdf
Size:
0.71 MB
Last modified:
2024/10/15
2011-01-25 - No Loitering - Exploiting Lingering Vulnerabilities in Default COM Objects.pdf
Size:
0.32 MB
Last modified:
2024/10/15
2010-01-12 - Exercising the Firewall using Cplusplus.pdf
Size:
0.09 MB
Last modified:
2024/10/15
2009-05-03 - PE Infection - How to Inject a DLL.pdf
Size:
0.69 MB
Last modified:
2024/10/16
2008-12-27 - Detailed Guide to PE Infection.txt
Size:
0.01 MB
Last modified:
2024/10/15
2006-05-22 - Windows Network Services Internals.pdf
Size:
1.69 MB
Last modified:
2024/10/15
2005-05-30 - Making WMI Queries In C.7z
Size:
0.29 MB
Last modified:
2024/10/15
2004-04-06 - Remote Library Injection.pdf
Size:
0.24 MB
Last modified:
2024/10/15
