Just saw an extended version

Random experiment to see if cheating in school could be stopped by designing math problems for children that AI will refuse to handle. Results are mixed.

less known way to calculate sha256 of files on Windows disksnapshot -c -k -v c:\test will print out file info including sha256 for every file in the directory

Just when you think you know your way around Linux.. binfmt_misc: Hold my beer. dfir.ch/posts/today_...

'One Battle After Another' and 'Frankenstein' brought my wife and I back to the cinema in recent weeks and it was totally worth it. Nothing beats the experience of a full immersion that only cinema can deliver. It helps that both movies are long.

China Domain Name Scammers target Hexacorn www.hexacorn.com/blog/2025/10...

1 little known secret of help.exe www.hexacorn.com/blog/2025/10...

1 little known secret of nslookup.exe, part 2 www.hexacorn.com/blog/2025/10...

1 little known secret of wsreset.exe www.hexacorn.com/blog/2025/10...

Forensics of the past www.hexacorn.com/blog/2025/10...

@sixtyvividtails.bsky.social any idea what fdwReason=5 stands for? you can find it inside verifier.dll / AVrfpMiniLoadAttach call - lots of LdrQueryImageFileKeyOption checks

ntprint.exe lolbin www.hexacorn.com/blog/2025/10...

Close your eyes and ✨imagine: From a low-integrity process (from LPAC even), you can inject your data anywhere you want: privileged tasks, PPL/protected processes, the OS kernel itself, and VTL1 trustlets. Now open your eyes. It is not hypothetical. It is the reality. Read it on page 33.

Using .LNK files as lolbins www.hexacorn.com/blog/2025/10...

RunDll Exporters www.hexacorn.com/blog/2025/09...

Enter Sandbox 30: Static Analysis gone wrong www.hexacorn.com/blog/2025/09...

Beyond good ol’ Run key, Part 151 www.hexacorn.com/blog/2025/09...

DLL ForwardSideloading, Part 2 www.hexacorn.com/blog/2025/09...

DLL ForwardSideloading www.hexacorn.com/blog/2025/08... using forwarded DLL functions for sideloading purposes

Beyond good ol’ Run key, Part 150 www.hexacorn.com/blog/2025/08...

Life of a blogger

@volexity.com has released updates to its #opensource GoResolver project and more! This work was part of a project for one of our #summerinternship students. Read more details about Volexity’s updated GoResolver projects + other #golang tools in our special blog post!

During my #BHUSA talk I've released many ETW research tools, of which the most notable is BamboozlEDR. This tool allows you to inject events into ETW, allowing you to generate fake alerts and blind EDRs. github.com/olafhartong/... Slides available here: github.com/olafhartong/...

CVE-2005-4560 and Windows Macros + all exploit packs roll in their graves when they see ClickFix and FileFix...

1 little known secret of advpack.dll, LaunchINFSection www.hexacorn.com/blog/2025/07...

1/ During a recent incident response case, we observed the following file access: \\localhost\C$\@ GMT-2025.06.21-10.53.43\Windows\NTDS\ntds.dit This is a clever method of accessing a Volume Shadow Copy (VSS) snapshot.

Beyond good ol’ Run key, Part 148 www.hexacorn.com/blog/2025/07...

Beyond good ol’ Run key, Part 147 www.hexacorn.com/blog/2025/07...

malmoeb.bsky.social is one of the best people to follow; in the era of generative AI it's easy to lose motivation for doing anything really, so his posts discussing so many interesting attacks is a breath of fresh air (and even if it is his AI posting it :-P, it's that very goo' ol' school vibe)

clever carding page hxxps://gov[.]comsitebab[.]life/gov when you visit from the desktop, it's just a regular website (although compromised) when you visit from a smartphone, you get a fake gov web site that harvests your CC details

Did you know Windows has built-in RAM disk? And not just your regular RAM disk. It's pmem/nvdimm, via built-in scmbus.sys facility! That means you can make 🦆🦆🦆 #dax volume, so data/image mappings (section views) will use "drive" directly! No data persistence, no w10; only ws2022/w11+. EZ 📀 create:

VMwareResolutionSet.exe VMwareResolutionSet.dll lolbin www.hexacorn.com/blog/2025/06...

wermgr.exe boot offdmpsvc.dll lolbin www.hexacorn.com/blog/2025/06... #lolbin

wpr.exe boottrace phantom dll axeonoffhelper.dll lolbin www.hexacorn.com/blog/2025/06... #lolbin

#HuntingTipOfTheDay: Services can provide persistence. Looking for changes to their commands is common, but the lesser known Environment setting is often overlooked. It could result in stealthy DLL hijacking. Inspect any paths referenced for suspicious files.

New #TinyTracer (v3.0) is out - with many cool features: github.com/hasherezade/... - check them out!

While investigating a compromised network, we found suspicious PowerShell code that ran on a domain controller. The script downloaded a file called chrome_installer.exe and installed it. We checked the file and found it was signed by Google, so it’s a genuine Chrome installer.

mscoree.dll, RunDll32ShimW lolbin www.hexacorn.com/blog/2025/05...

youtu.be/5PCU48nqAIw?... start at 10:20 of the cross questioning the expert on their CV and credentials in the Karen Read trial. Shanon Burgess. #DFIR

Shell32.dll, #44 lolbin www.hexacorn.com/blog/2025/05...

We are VERY excited to announce that Volatility 3 has now reached feature parity with Volatility 2! With this parity release, Volatility 2 is now deprecated. Full details in the blog post linked below.

Heard of #ContextJail? It's a nasty new technique: puts target thread into ⓪ deadloop, for as long as you can afford. Requires THREAD_GET_CONTEXT right. The gist? Just spam NtGetContextThread(tgt).😸 Target will be jailed, running nt!PspGetSetContextSpecialApc 🔁. Src & binary in [ALT]. Usecases: ⤵️

Glad Skype data deletion works

Minority (forensic) report aka defending forward w/o hacking back www.hexacorn.com/blog/2025/05... #dfir

AI worms in the making ;) www.cmdzero.io/blog-posts/i...

Every once in a while I get a blast from the past Yesterday someone thanked me for creating Dexray - a perl script that decrypts many quarantine files created by security solutions - since it is an obsolete tool today - it was totally surprising/unexpected, but it also made my day. Thank you!

2025 - the first April Fool's Year hence April Fool's Day should reverse its meaning

Malware Source code string extraction www.hexacorn.com/blog/2025/03...

1/ Section two of my Tear Down The Castle series is about highly privileged service accounts. [1] The screenshot below is from an Incident Response engagement we worked on recently. Yes, you guessed right, one of the service accounts has fallen, along with the whole domain.