EDR Evasion248 Direct $MFT parsing walks the on-disk NTFS Master File Table through a raw volume handle, producing a full inventory of files, deleted…
Cybersecurity196 Process Parameter Poisoning (P3) is a stealthy process injection technique that abuses Windows startup parameters to transfer and execute code in a…
EDR Evasion113 klezVirus introduces frame swapping — a technique that hides Windows callback frames from EDR call-stack inspectors while preserving return value recovery. Building…
EDR Evasion65 Two Python shellcode stagers from g3tsyst3m that hit 0/63 on VirusTotal — Variant #1 uses string-reversed NT APIs (NtAllocateVirtualMemory, NtCreateThreadEx) plus RWX…
EDR Evasion89 Mohamed Alzhrani's LACUNA Chain combines BYOUD-Gap, the ETW-Ti APC window, win32u's 1,242 NOP gaps, ntdll/kernelbase ghost functions, BYOUD-MF machine-frame RSP teleport, BYOUD-RT…
EDR Evasion52 cocomelonc’s tabby is a tiny teaching framework for writing position-independent Windows x64 shellcode in C, with indirect NT syscalls and no IAT,…
EDR Evasion32 Praetorian’s Centurion is a virtualized loader built around a custom x86-64-inspired ISA and freestanding C runtime, where the PE loader, TLS stack…
EDR Evasion32 BusyWork is a Rust library that swaps every sleep() call for a randomized cocktail of real work across seven categories — compute,…
APC28 The 2017 Windows research demo that flipped page protections so a shellcode region was non-executable at scan time and executable only during…
Bypassing50 A walkthrough of klezVirus' "Callback hell" — a technique that hides callback frames from stack inspectors by combining tail-calls, forward and backward…
EDR841 A walkthrough of "APC Tandem", a stealth Windows process-injection technique that replaces WriteProcessMemory, CreateRemoteThread and VirtualAllocEx with a chain of less-watched primitives…
