MALOCT 3114m
Unhooking ntdll: removing EDR's eyes
How userland hooks work, how to remove them, and why the technique is less effective than the blogs suggest.
- #EDREvasion
- #Unhooking
- #ntdll
IndexAll entries
nothing withheld.
Root cause, reproduction, and the telemetry that follows. Everything here was built and broken in an isolated lab, then written down so it can be criticized.
CVE ROOT CAUSE◆IMPLANT ENGINEERING◆AD ATTACK PATHS◆DETECTION FIRST◆LAB-DERIVED ONLY◆NO CLIENT DATA◆CVE ROOT CAUSE◆IMPLANT ENGINEERING◆AD ATTACK PATHS◆DETECTION FIRST◆LAB-DERIVED ONLY◆NO CLIENT DATA◆
All research
Newest first. Every entry is lab-derived.
MALOCT 3017m
Process injection, end to end
Classic injection, APC injection, and process hollowing with working code, compile commands, and the detection surface for each.
- #ProcessInjection
- #APC
- #Hollowing
MALOCT 2915m
Advanced static AV bypass: from signature to silence
A field manual for making a PE invisible to static scanners: entropy, section names, API hashing, string obfuscation, and the compile flags that matter.
- #AVEvasion
- #StaticAnalysis
- #PE
CVEOCT 1810m
CVE-2026-111998 — Vanus: the Hardcoded `admin` Token That Owns the Cluster
A hardcoded admin token in Vanus grants cluster-admin to anyone who guesses it.
- #Vanus
- #DefaultCredentials
- #CWE-1392
CVEOCT 1811m
CVE-2026-111999 — Vanus: Unauthenticated CloudEvents Publish on Port 8081
Unauthenticated CloudEvents publish on Vanus gateway port 8081.
- #Vanus
- #MissingAuth
- #CWE-306
CVEOCT 1812m
CVE-2026-112000 — Vanus: Missing Authorization in Gateway Streaming RPCs
Missing authorization in Vanus gateway streaming RPCs and default-allow policy.
- #Vanus
- #MissingAuthz
- #CWE-862
MALOCT 1216m
Sleep obfuscation, from first principles
Ekko, Foliage, and timer-queue sleep obfuscation compared under the same memory scanner. The writeup is the thesis; the harness is proof.
- #SleepObfuscation
- #Ekko
- #Foliage
CVEOCT 0714m
CVE-2026-106058 — GNU GitAhead: OS Command Injection in Filter.cpp → Live RCE
OS command injection in GitAhead Filter.cpp via unquoted filenames handed to bash -c.
- #GitAhead
- #CommandInjection
- #CWE-78
CVEOCT 0713m
CVE-2026-106059 — GNU GitAhead: \"Show in Finder\" AppleScript Injection on macOS
AppleScript injection in GitAhead ShowTool on macOS via unescaped filenames.
- #GitAhead
- #AppleScript
- #macOS
CVEOCT 0511m
CVE-2026-105295 — GNU GitAhead: Unverified Update Installation and TLS Bypass
Unverified update installation and a persistent TLS bypass in GitAhead 2.5.0-2.7.1.
- #GitAhead
- #Updater
- #TLS
RTOCT 0113m
NTLM relay to ADCS: ESC8 from a standing start
Relaying NTLM to Active Directory Certificate Services web enrollment to mint a DC certificate and DCSync.
- #ADCS
- #ESC8
- #NTLMRelay
CVESEP 2812m
CVE-2026-102333 — or: How a Pure-Python HTTP Debug Tool Taught Me Not to Trust Lovingly Escaped HTML
Stored XSS in httpdbg via a javascript: URL scheme that survives Mustache HTML-encoding.
- #httpdbg
- #StoredXSS
- #Python
RTSEP 1211m
Kerberoasting without the noise
Requesting and cracking service tickets while keeping the opsec footprint low and the detection path visible.
- #Kerberos
- #Kerberoasting
- #Opsec
MALSEP 0518m
PE loader from scratch
Writing a minimal PE loader to understand how Windows maps and executes binaries, and where detection can land.
- #PE
- #Loader
- #Windows
MALAUG 2810m
Indirect syscalls are not a personality
Why indirect syscalls buy less than people think, and what the detection side actually keys on.
- #Syscalls
- #EDREvasion
- #Detection
NTSJUL 309m
Build a lab that survives its own success
Lab builds, opsec, and the small decisions that keep an engagement clean and a research habit alive.
- #Lab
- #Opsec
- #Methodology
No index is complete without the next one.
The dispatch carries one long-form writeup, roughly twice a month. Same standard, same lab, no drip feed.