Security Analyst and Researcher. Trying very hard to figure out C, Assembly and Windows Internals. Eternal N00b.🐶pushpopret.com Instruction PointerJoined March 2018
this is my short analysis of a little-known security feature built into Windows that inadvertently broke one of our authenticode signatures recently elastic.co/security-labs/…
You want to load your shellcode in .NET without calling VirtualProtect? Use RuntimeHelpers.PrepareMethod to create a predictable RWX memory region for you. This method also doesn't require a delegate function pointer, since you override a .NET method.
github.com/Mr-Un1k0d3r/Do…
Black Hat Bonus: Learn more about @kyleavery_ 's research on training self-hosted LLMs to generate evasive malware and creation of a 7B parameter model that generates evasive Cobalt Strike shellcode loaders able to bypass Microsoft Defender for Endpoint. ow.ly/1EUf50WBI5e
I was messing around with symbol resolution in ELF and came up with an obfuscation technique on abusing symbol resolution in ELF programs that is able to trick tools (i.e. Ghidra, IDA, GDB) into showing the wrong library function calls.
blog.elmo.sg/posts/breaking…
Under-the-hood, Ember uses LightGBM to score a sample from 0 to 1. I added this functionality into Citadel so any binaries added to the framework are now summarised and scored as well as the rest of the Citadel analysis. Read it here: mez0.cc/posts/citadel-…
This is my research project in creating read, write and allocate primitives that can be turned into an injection in order to evade certain telemetry which I presented last year in RedTreat. I hope everyone likes it \m/.
trickster0.github.io/posts/Primitiv…
Windows 11 24H2 broke a popular malware evasion technique! The Lloyd Labs self-deletion method now fails because of NTFS changes, so I spent time with kernel debugging to figure out why and how to fix it.
Full technical breakdown: tkyn.dev/2025-6-8-The-N…
Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been working on for the past couple months.
This dives into DCOM Interfaces that enable remote ETW trace sessions without dropping an agent to disk.
Includes a detailed…
RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.
Hope you enjoy the blog & tool drop 🤟
ibm.com/think/x-force/…
(1/x) For some reason people keep asking me how to get into reverse engineering. The obvious answer would be do CTFs or reverse malware (aka just do it), but I also think game hacking/modding (not cheating!) can be fun and still provide the same learning experience.
An example:
The fifth article (57 pages) of the Exploiting Reversing Series (ERS) is available on:
exploitreversing.com/2025/03/12/exp…
I would like to thank Ilfak Guilfanov @ilfak and Hex-Rays SA @HexRaysSA for their constant and uninterrupted support, which have helped me write these articles over…
In our new blog, Research Practice Lead @freefirex2 walks us through how to modify the system routing table when connecting to a virtual private network (VPN) with basic, user-level access. Read it now! hubs.la/Q03bh2bg0
reconftw v3 is out! Major updates: @faradaysec Faraday & @arcanuminfosec msftrecon, pipx & venv installer, ton of macOS/*nix fixes, enhanced fuzzing/JS functions, and more. Huge thanks to pgrenaud and tux3d0! Check the details: github.com/six2dez/reconf…
223K Followers 6K FollowingFounder @Binary_Defense @TrustedSec Co-Owner https://t.co/HQC75WhdJh. @WeHackHealth Pod. God + Family/Hacker/CSO/USMC/Intel/Fitness. Make the world a better place.
1K Followers 71 FollowingAdvanced sandbox-based system specifically designed and built for detecting file-based zero-day and hard-to-detect exploits. By @HaifeiLi.
12 Followers 324 FollowingTech enthusiast and lifelong learner. Always on the lookout for the latest and greatest in the world of technology, if it involves technology, I'm interested.
3K Followers 2K FollowingAll things AI and Cybersecurity.
Founder of Transilience @transilienceai, Network Intelligence @niiconsulting, and Institute of Information Security @iinfosec.
277 Followers 945 FollowingI can explain it to you, BUT I can’t understand it for you.... / IT-OT Cybersecurity / Automation / Robotics / Hacker 2.1 / opinions = my own
2K Followers 2K FollowingGIAC x10 | SANS MSISE Grad | OSCP | Offensive AF | OIF Veteran | Tweets are mine, not yours, nor anyone else's... Certainly not my employer's.
223K Followers 6K FollowingFounder @Binary_Defense @TrustedSec Co-Owner https://t.co/HQC75WhdJh. @WeHackHealth Pod. God + Family/Hacker/CSO/USMC/Intel/Fitness. Make the world a better place.
386K Followers 622 FollowingLove Linux/Unix, open source, and programming? Into Sysadmin & DevOps? Follow us! Boost your IT career with daily new tools, apps, and humor ⤵️
77K Followers 765 FollowingEnd-to-end Cybersecurity consulting team leading the industry, supporting organizations, and giving back. #Hacktheplanet
Blogs, news, webinars, and tools!
14K Followers 916 FollowingWindows Internals expert, author, and trainer. Teaching system programming & debugging at TrainSec. Check out my books & courses! 🚀 #WindowsInternals #TrainSec
30K Followers 562 FollowingCyBeRsEcUrItY | Not afraid to put down with some THICC malware on disk | securing and breaking AI @PaloAltoNtwks | Ex @spacex
1K Followers 71 FollowingAdvanced sandbox-based system specifically designed and built for detecting file-based zero-day and hard-to-detect exploits. By @HaifeiLi.
8K Followers 151 FollowingFor contact in the security community. NOTE: All the tweets are totally my personal opinions, not about any of my current employer stuff.
17K Followers 0 Followingsecret club is a not-for-profit reverse-engineering group; publishing new research on popular software.
No ads, no cookies, just research.
13K Followers 508 FollowingI don't know how to search on Google so I do research on my own and tweet about it. Hacking as a life style
https://t.co/a05mevChzu
5K Followers 427 FollowingCyberSecurity researcher and founder of BallisKit. I have a passion for all infosec subjects especially redteam and writing offensive tools!
16K Followers 274 FollowingExecutive Director for Intelligence and Research @SentinelOne | Distinguished Fellow, @SAISHopkins Alperovitch |LABScon|Cyber Paleontologist|4thParty Collector
15K Followers 0 FollowingConsultancy and Training from a trusted supplier of offensive security. Red Team and Adversary Simulation by ActiveBreach team | https://t.co/fqpbJ9WDXD | https://t.co/UvOhGA4Zou