Explore a sophisticated kernel-level technique that mutates process identity structures to evade Sysmon telemetry. This research demonstrates how patching EPROCESS.UniqueProcessId and ETHREAD.Cid fields enables complete false attribution of system activity, bypassing traditional EDR detection.
oxfemale
August 28, 2026
8 min read
294 
Red Team Operations318 BOFScale combines a modified Tailscale daemon, client, and port forwarder running as Beacon Object Files to enable in-memory C2 networking infrastructure through…
BYOVD339 CVE-2020-12446 in eneio64.sys does not corrupt anything. Its MAPPHYSTOLIN handler opens \Device\PhysicalMemory and maps the entire physical address space, read/write, into whichever…
Exploit Development315 Examining advanced shellcode architecture that eliminates reflective loaders while maintaining position independence and global instance management. This deep dive into the Stardust…
AI Security Research331 A path traversal in darwin-init, the PID 1 process that provisions every Apple Private Cloud Compute node, gave a researcher an arbitrary…
Exploit Development333 Every hardware security boundary on a modern x86 platform — SMRAM, the AMD PSP's private DRAM, the C6 save area, the live…
Audio276 veffects analyzes any track — mp3, wav, flac or midi — into a compact 160-bytes-per-frame “score” of audio features, then renders 28…
Defender377 On 12 August 2026 Nightmare Eclipse published ShieldBreak, a proof of concept that defeats Microsoft's July fix for CVE-2026-50656 (RoguePlanet) and escalates…
Application Security574 HTTP header injection has been under-rated for twenty years. This research shows how one injected CRLF sequence in an Nginx-normalised path escalates…
AI Security Research337 Writing the harness is the friction that keeps most codebases from ever being fuzzed. This walkthrough puts an offline open-weights model behind…
buffer overflow308 A single byte written past the end of a PagedPool allocation in a Windows 10 x64 kernel driver, followed all the way…
buffer overflow314 A complete hardware-to-firmware walkthrough of the Mercusys MB115-4G, the best-selling router on Amazon Spain: pre-purchase firmware recon, PCB teardown, UART pinout discovery…
Application Security318 CVE-2026-71320 lets an attacker inject a template key into Nuxt server island props and have Vue's runtime compiler execute it inside the…
