Bypassing18 The article explains enhancing RPC Proxy Injection to evade Elastic EDR telemetry by avoiding common API calls like WriteProcessMemory and CreateRemoteThread, using…
Containers28 libraries for packaging, verifying, decrypting, and executing WebAssembly plugins packaged in a custom container format .mylib (version 2).
cpp38 Red team technique—process injection—and how to leverage it against Protected Process Light (PPL)
Bypassing22 The post explores how Windows security products use kernel image load notifications to monitor when executables and DLLs are loaded by the system. These…
