Bypassing153 Abusing Microsoft Warbird for Shellcode Execution
The article demonstrates an EDR bypass by using an undocumented Warbird interface to stealthily load shellcode.
oxfemale·
Feb 4·
15 min
·153
//
370 postsBypassing153 
alloc137 NO ALLOC, NO PROBLEM: LEVERAGING PROGRAM ENTRY POINTS FOR PROCESS INJECTION
Remote process injection and looking for a few under-the-radar techniques that were either not documented well and/or contained minimalist core requirements for…
oxfemale·
Feb 3·
7 min
·137
BYOVD141 Using EDR-Redir To Break EDR Via Bind Link and Cloud Filter
the technique of exploiting the Bind Filter driver (bindflt.sys) to redirect folders containing the executable files of EDRs to a location that I completely…
oxfemale·
Feb 3·
7 min
·141
AV185 AV EDR Killer Project
av-edr-kill is a BYOVD (Bring Your Own Vulnerable Driver) proof-of-concept whose goal is to terminate security-product processes (AV/EDR), including Protected Process Light…
oxfemale·
Feb 2·
2 min
·185
Containers235 Securely Embedding WASM Plugins in Your Project
libraries for packaging, verifying, decrypting, and executing WebAssembly plugins packaged in a custom container format .mylib (version 2).
oxfemale·
Feb 2·
2 min
·235
ASM238 Mastering Living off the Process in Offensive Security
No need for overusing WriteProcessMemory, VirtualAlloc, injecting a DLL, etc. This way, everything you need to manipulate the remote process is self-contained…
oxfemale·
Feb 2·
30 min
·238
cpp318 Exploring Protected Process Light and Exploits
Red team technique—process injection—and how to leverage it against Protected Process Light (PPL)
oxfemale·
Feb 2·
28 min
·318
Bypassing210 Bypassing Image Load Kernel Callbacks
The post explores how Windows security products use kernel image load notifications to monitor when executables and DLLs are loaded by the system. These…
oxfemale·
Jan 30·
12 min
·210
Injection213 Mastering APC Injection with QueueUserAPC2
In this article, I will demonstrate one of the classic, fundamental techniques for injecting shellcode into a remote process using APCs. I…
oxfemale·
Jan 30·
14 min
·213
Audio237 DLL Hijacking in Windows Audio: A New Escalation Technique
Original post by S1lky This article describes DLL hijacking in the context of the audiodg.exe process which may load vendor-supplied APO-related DLL…
oxfemale·
Jan 30·
17 min
·237
Administrator211 Bypassing Windows Administrator Protection
Original text by James Forshaw A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of…
oxfemale·
Jan 30·
22 min
·211
winapi207 The Definitive Guide To Process Cloning on Windows
Original text by DENIS NAGAYUK & FRANCISCO DOMINGUEZ This article aims to provide the reader with a comprehensive guide to the technical details and…
oxfemale·
Nov 26·
28 min
·207
Countering EDRs With The Backing Of Protected Process Light (PPL)
Original post by Zero Salarium / link . INTRO Important or sensitive processes of modern Windows operating systems are now protected by…
oxfemale·
Sep 22·
6 min
·261