ZettelForge - Agentic Memory System for Cyber Threat Intelligence

Fixing Mimikatz sekurlsa::logonpasswords on Windows 11 24H2/25H2

Proof-of-concept security demo illustrating how PowerShell can create trusted-looking Windows toast notifications chained together with ClickFix-style lure

Abusing Some Defects in KSLD Ark driver

MCP to help Defenders Detection Engineer Harder and Smarter

Abusing WinML for In-Memory Staging and EDR Evasion

The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem

Detecting CI/CD Supply Chain Attacks with Canary Credentials

PoisonKiller: Another BYOVD process killer. works on CrowdStrike. fully signed.

VMware Guest To Host

Qilin EDR killer infection chain

WinDefenderKiller - implements a BYOVD (Bring Your Own Vulnerable Driver) technique to disable Windows Defender by continuously terminating its processes

ghostsurf: From NTLM Relay to Browser Session Hijacking

Bypassing Code Integrity Using BYOVD for Kernel R/W Primitives

Creative approaches to coding FUD Stagers

Exploring cross-domain & cross-forest RBCD

BridgeHead: Native C++ access to Active Directory over ADWS, no .NET, no WCF, no HTTP stack

Abusing Modern Browser Features for Phishing

A Sliver dropper that asks GPT-4 for permission

Detection of indirect syscall techniques using hardware breakpoints and vectored exception handling

Exploiting Ghost SPNs and Kerberos Reflection for SMB Privilege Elevation

ShareHound: An OpenGraph Collector for Network Shares

sideloading PoC using onedrive.exe & version.dll

ShareHound: A python tool to map the access rights of network shares into a BloodHound OpenGraphs easily

Machines Gone Rogue

EDR-Redir V2: Blind EDR With Fake Program Files

Protecting C2 Traffic in Nim

Beacon Object File (BOF) to steal Microsoft Teams cookies

BOF to steal Teams cookies

Tracking Lateral Movement: PowerShell Remoting, WMIC, Explicit Credentials, NTLM Relay Attacks

Blog MSSQL Exploitation - Run Commands Like A Pro

Curly COMrades: Evasion and Persistence via Hidden Hyper-V Virtual Machines

Atomic Red Team MCP #2 - Claude becomes C2

Weekly Purple Team Episode: CVE-2025-59287 - Exploiting & Detecting the Critical WSUS RCE

Evading Elastic EDR's call stack signatures with call gadgets

Close Those Ports: Exploring Splashtop RMM and Relays

Yet Another DCOM Object for Command Execution Part 1

NTLM-Relaying in 2026

Operation Storming Tide: A massive multi-stage intrusion campaign

KslKatz: Combining KslDump and GhostKatz to dump LSASS using no-vulnerability KslD.sys memory read to bypass PPL. Extracts MSV1_0 NT hashes and WDigest cleartext passwords (if enabled) from LSASS using a Microsoft-signed driver.

teletunnel: Bypassing EDR's with stealthy c++ telegram Bot and Telegram itself as C2 interface

Every Sliver C2 Tutorial Was Outdated. So I Wrote My Own

Sleeping Beauty: Putting Adaptix to Bed with Crystal Palace

MANGO SANDSTORM Dindoor / Fakeset Campaign

RegPhantom Backdoor Threat Analysis

EDR killers explained: Beyond the drivers

FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops

Initial access techniques used by Iran-based threat actors

Offensive Cases about Credential Guard & Detection Strategies

Payload ransomware group: mutex MakeAmericaGreatAgain