FFE4 @KernelDBG

I'm a virus analyst focus on Windows Security Research,Exploit Development Joined July 2016

Tweets

3K
Followers

292
Following

3K
Likes

3K

kr0tt @_kr0tt

a month ago

Wrote a blog about creating an early exception handler for hooking and threadless process injection without relying on VEH or SEH. You can definitely use it for more than what is described in the post, enjoy :) kr0tt.github.io/posts/early-ex…

2 60 152 16K 119

Two Seven One Three @TwoSevenOneT

3 weeks ago

It looks like an executable file with a .jpg extension from the early 2000s. But no! This is a method to create persistence with a non-existent executable file to bypass #antimalware #PenTesting #BlueTeam

4 39 159 14K 86

Download Image

db @whokilleddb

a month ago

Another hoontr find: tprtdll.dll (like so many others) exposes some Nt/Rtl/Zw functions. It doesn't redirect to ntdll, instead it makes the syscall itself - so you can call something like NtAllocateVirtualMemoryEx without ever touching ntdll! PoC: github.com/whokilleddb/fu…

6 78 335 24K 222

Download Image

Two Seven One Three @TwoSevenOneT

2 months ago

#redteam Hey, look! Windows with two "System32" folders.😲 Hey, keep looking at this! A process loads the same DLL twice and keeps both instances in memory.😲 #malware #blueteam

6 51 481 37K 207

Download Image

Outflank @OutflankNL

2 months ago

Black Hat Bonus: Learn more about @kyleavery_ 's research on training self-hosted LLMs to generate evasive malware and creation of a 7B parameter model that generates evasive Cobalt Strike shellcode loaders able to bypass Microsoft Defender for Endpoint. ow.ly/1EUf50WBI5e

0 48 106 9K 53

Download Image

Two Seven One Three @TwoSevenOneT

2 months ago

#redteam If you name the file long enough, your file will vanish from the Process Explorer Lower Pane. 😂 #blueteam #pentest

7 148 2K 91K 600

Download Image

IIJ-SECT @IIJSECT

2 months ago

Unicornを使ったマルウェア解析の効率化 | IIJ Security Diary sect.iij.ad.jp/blog/2025/08/m… @IIJSECT

1 26 101 8K 70

Alex Plaskett @alexjplaskett

2 months ago

Out Of Control: How KCFG and KCET Redefine Control Flow Integrity in the Windows Kernel by @33y0re i.blackhat.com/BH-USA-25/Pres…

0 38 129 17K 64

Download Image

Lloyd Davies @LloydLabs

2 months ago

github.com/LloydLabs/dele… now works on Windows 11 24H2! 🥳

3 39 173 15K 141

Paweł Hałdrzyński @phaldrzynski

2 months ago

Nice trick showing that the very same zip can be seen differently by two different programs. I've examined how this quirk could help us in zip path traversal attacks: blog.isec.pl/disguises-zip-…

Gynvael Coldwind @gynvael

3 months ago

Nice trick showing that the very same zip can be seen differently by two different programs. I've examined how this quirk could help us in zip path traversal attacks: blog.isec.pl/disguises-zip-…

1 25 105 24K 76

Download Image

0 25 85 11K 67

SSD Secure Disclosure @SecuriTeam_SSD

2 months ago

Want to learn about Chrome exploitation and the role of WebAssembly in it? In our new article, we'll break down the world of WASM, how it interacts with V8, and use CVE-2024-2887 as a case study to show how flaws in WASM can lead to RCE. Read it here: ssd-disclosure.com/an-introductio…

0 32 182 218K 147

NULL @NUL0x4C

2 months ago

Dropped a PoC demonstrating how to leverage “IOCTL_VOLSNAP_DELETE_SNAPSHOT” (0x53C038) to delete Windows shadow copies github.com/NUL0x4C/IOCTL_…

1 29 106 5K 44

Prelude Research @PreludeResearch

2 months ago

Announcing our whitepaper on the future of endpoint security. preludesecurity.com/runtime-memory…

6 87 286 52K 190

Florian Hansemann @CyberWarship

2 months ago

''Windows Inter Process Communication A Deep Dive Beyond the Surface - Part 2'' #infosec #pentest #redteam #blueteam sud0ru.ghost.io/windows-inter-…

0 20 44 3K 35

安坂星海 Azaka || VTuber @AzakaSekai_

2 months ago

This was kinda interesting to run into in the wild - the developer of this malware wanted to to terminate all TCP connections of a process via the TCP table. Instead of using SetTcpEntry, they reimplemented the entire function by copying the underlying implementation from…

7 45 461 30K 193

Download Image

Alan Sguigna @AlanSguigna

2 months ago

Here are the links to the recordings of my prior two webinars: Debug of Hyper-V, Secure Kernel, VBS Enclaves, Defender, and other secrets: attendee.gotowebinar.com/recording/3590… and Advanced Threat Analysis and Reverse Engineering using AI: attendee.gotowebinar.com/recording/4436…

0 18 44 4K 27

Download Image

Alex @xaitax

2 months ago

New Chrome App-Bound Encryption Decryption, centered on a new evasion paradigm: Direct Syscall-Based Reflective Hollowing. 👻 Hollowing > Attaching: The entire injection workflow now targets CREATE_SUSPENDED processes. This gives uncontested control of the address space,…

5 33 112 11K 56

Download Image

Connor McGarr @33y0re

2 months ago

I don't know which update specifically, but in a recent update of 24H2 it looks like the Win32k system call table is protected by Kernel Data Protection (read-only SLAT entry)! I believe CI!g_CiOptions and msseccore's SecKdpSe PE section were the only things using it before.

3 21 118 11K 31

Download Image

SEKTOR7 Institute @SEKTOR7net

2 months ago

Bypassing AMSI with your own custom COM interfaces inside CLR process - an excellent piece by Joshua Magri (@passthehashbrwn). The custom implementation allows to allocate and load assemblies from memory and invoke Load_2() method instead of typical call to Load_3(). This…