MJ’S BLOG
Subscribe
Lab onlineDispatch

Break it.Explain it.Detect it.

Long-form malware development, CVE research, and red team tradecraft from a working offensive security engineer. Every technique is documented with the telemetry it leaves behind — because the detection is part of the finding.

Read the latestBrowse the archive
Dispatch queuelive
lab-derived · source-linkedFull index →
CVE-2024-3400◆NTLM RELAY → ESC8◆SLEEP OBFUSCATION◆PE LOADER FROM SCRATCH◆INDIRECT SYSCALLS◆KERBEROASTING OPSEC◆AD CS · ESC 1–8◆DETECTION SHIPS FIRST◆NO LIVE TARGETS◆CVE-2024-3400◆NTLM RELAY → ESC8◆SLEEP OBFUSCATION◆PE LOADER FROM SCRATCH◆INDIRECT SYSCALLS◆KERBEROASTING OPSEC◆AD CS · ESC 1–8◆DETECTION SHIPS FIRST◆NO LIVE TARGETS◆
01Featured research

The entries that set the tone.

Three deep dives spanning edge-device exploitation, implant engineering, and the identity paths that still work on hardened networks.

All writeups
MALOCT 1216m

Sleep obfuscation, from first principles

Ekko, Foliage, and timer-queue sleep obfuscation compared under the same memory scanner. The writeup is the thesis; the harness is proof.

  • #SleepObfuscation
  • #Ekko
  • #Foliage
Editorial rule

If it cannot be reproduced from the post, it does not go in the post.

Every writeup includes the lab setup, the failed attempts, the code that mattered, and the detection surface it creates. No hero screenshots, no withheld primitives.

MJ’s Blog · research standard v2
02The archive, in motion

Everything, newest first.

A horizontal cut through the archive. Swipe, drag, or use the controls — the entries stay in chronological order.

Open index
SWIPE
MALOCT 3017m

Process injection, end to end

Classic injection, APC injection, and process hollowing with working code, compile commands, and the detection surface for each.

  • #ProcessInjection
  • #APC
RTSEP 1211m

Kerberoasting without the noise

Requesting and cracking service tickets while keeping the opsec footprint low and the detection path visible.

  • #Kerberos
  • #Kerberoasting
MALSEP 0518m

PE loader from scratch

Writing a minimal PE loader to understand how Windows maps and executes binaries, and where detection can land.

  • #PE
  • #Loader
03Research tracks

Four ways into the work.

Each track has its own standards, its own failure modes, and its own detection story. Pick the one you came for.

01C

CVE Research

Root cause first. Public advisories, patch diffs, and the detection gaps that survive the patch.

7 entries

CVE-2026-111998 — Vanus: the Hardcoded `admin` Token That Owns the Cluster

Enter hub
02M

Malware Development

Loaders, sleep obfuscation, and the engineering trade-offs behind implants. Built to understand, not to ship.

6 entries

Unhooking ntdll: removing EDR's eyes

Enter hub
03R

Red Team

Adversary emulation, identity abuse, and the operational discipline that separates a finding from a story.

2 entries

NTLM relay to ADCS: ESC8 from a standing start

Enter hub
04N

Field Notes

Lab builds, opsec, and the small decisions that keep an engagement clean and a research habit alive.

1 entry

Build a lab that survives its own success

Enter hub
04The lab

Tools built to answer questions, not to sell.

A small, opinionated arsenal. Everything runs in an isolated forest or a disposable VM, and everything is documented well enough to be criticized.

4 projects tracked
ldr-01
Active

Hollowpoint

/ Loader

A staged PE loader with indirect syscall resolution, per-build API hashing, and a signed-host side-loading path. Used to study how much of a modern loader is actually necessary.

0 / 68

static detections

cnf-04
Active

Sleepwalk

/ Evasion

A sleep-obfuscation harness that compares Ekko, Foliage, and timer-queue approaches under the same memory scanner. The writeup is the thesis; the harness is proof.

3

techniques compared

ad-07
Field-tested

WrongWay

/ Red team

AD CS enumeration and ESC-chain validation kit. Coerce, relay, enroll, then prove impact without leaving a domain controller in a broken state.

ESC 1-8

paths covered

det-02
In progress

ColdOpen

/ Detection

A detection harness that replays real telemetry against Sigma rules and scores coverage per ATT&CK technique. Built so writeups end with something a blue team can use.

142

rules mapped

Lab policy: no live targets · no client data · no uncoordinated disclosure

Read the field notes
ID // MJ-0001Active
MJ
OperatorOffensive security
ClearancePublic research only
Focus
Malware dev · AD · CVE research
Environment
Windows internals, Linux, isolated AD forest
Writing
Long-form, reproducible, source-linked
Availability
Select engagements & reviews

About the author

I break things in a lab, then write down exactly how.

I’m MJ (Dhurgesh) — a security researcher and student. I work across malware development, Active Directory attack paths, and vulnerability research. Most of what lands here starts as a lab question that refused to stay small: why a loader survives one scanner and dies to another, why a patch closes a CVE but not the class of bug behind it, why a detection looks good on paper and never fires.

The writing is deliberately slow. Each entry includes the setup, the failing attempts, the code that mattered, and the detection surface the technique creates. If a claim cannot be reproduced from the post, it does not belong in the post.

7

CVEs published

13

Public writeups

4

Research tracks

01

Root cause over payload

A working exploit is not an explanation. Patch diffs and primitive-level reasoning come first.

02

Detections ship with the writeup

Every offensive technique ends with the telemetry it produces and the rule that catches it.

03

No live targets, no exceptions

Research happens in a lab I own. Disclosure follows coordinated timelines, not posting schedules.

mj@mjblog.devRead the archive

The dispatch

Get the next one before it gets patched.

One long-form writeup, roughly twice a month. Malware engineering, CVE root cause, and the telemetry that catches both.

PGP ok

No tracking pixels · one email, twice a month