EDR525 SyscallRevenant: Clean Indirect Syscalls with Trap-Flag Tracing
Clean indirect syscalls on Windows x64. It single-steps a hooked ntdll stub with the CPU trap flag to learn the live System…
oxfemale·
Oct 19·
31 min
·525
// EDR
43 postsEDR525 
AI Agents746 Bypassing EDR with Local AI
Eddie Zhang / Project Black: Claude refuses an LSASS dumper; DeepSeek builds one EDR still catches; uncensored Qwen 3.8 27B on two…
oxfemale·
Oct 2·
12 min
·746
Cybersecurity987 Process Parameter Poisoning: EDR Evasion via Windows Process Startup Parameters
Process Parameter Poisoning (P3) is a stealthy process injection technique that abuses Windows startup parameters to transfer and execute code in a…
oxfemale·
Jul 9·
16 min
·987
Bypassing516 Callback Hell: Abusing Callbacks, Tail Calls, and Proxy Frames to Obfuscate the Stack
A walkthrough of klezVirus' "Callback hell" — a technique that hides callback frames from stack inspectors by combining tail-calls, forward and backward…
oxfemale·
May 24·
16 min
·516
BYOVD826 BYOVD Attack Surface: From Vulnerability-Driven to Certificate Abuse
Between 2025 and 2026, BYOVD attacks completed a fundamental paradigm shift: from exploiting known-vulnerable drivers to abusing legitimately-signed drivers and certificates themselves.…
oxfemale·
May 24·
20 min
·826
EDR1.3k APC Tandem: A Primitive-Chaining Process Injection That Slips Past Common EDR Triggers
A walkthrough of "APC Tandem", a stealth Windows process-injection technique that replaces WriteProcessMemory, CreateRemoteThread and VirtualAllocEx with a chain of less-watched primitives…
oxfemale·
May 23·
26 min
·1.3k
GhostTree: The NTFS Trick That Can Make Malware Disappear from EDR Scans
GhostTree abuses NTFS junctions to create recursive, near-endless valid paths. Recursive scanners and EDRs can hang in the maze while malware in…
oxfemale·
May 21·
10 min
·331
Bypassing426 Building a DIY EDR from Scratch: Windows Kernel Callbacks, User-Mode Hooks, and Shellcode Injection Detection
A hands-on guide to building a basic Windows EDR with a kernel driver, callbacks, static analysis, DLL injection, and hooks to detect…
oxfemale·
May 13·
46 min
·426
AMSI395 Patchless AMSI Bypass via Page Guard Exceptions
The article shows a patchless AMSI bypass using Page Guard exceptions and VEH to intercept AmsiScanBuffer, force an early clean return, and…
oxfemale·
May 5·
14 min
·395
Bypassing502 Silencing the EDR Silencers
The article shows how attackers silence EDRs with firewall/WFP rules that block cloud communication, and how defenders can prevent or rapidly remove…
oxfemale·
May 5·
11 min
·502
.NET392 Evading Antivirus: Bypassing Windows Defender with Tenebris-Gate
The article presents Tenebris-Gate as a layered Windows Defender evasion framework using shellcode encryption, API hashing, anti-debugging, sandbox delays, syscall tricks, and…
oxfemale·
May 4·
4 min
·392
EDR276 Internal NTDLL Functions for Shellcode Execution
The article tests a shellcode execution trick using a private NTDLL function as an indirect call gadget, but notes it may offer…
oxfemale·
May 4·
9 min
·276