Bypassing50 A walkthrough of klezVirus' "Callback hell" — a technique that hides callback frames from stack inspectors by combining tail-calls, forward and backward…
Malware46 A practical look at DLL sideloading and proxying: how attackers abuse trusted Windows executables to load malicious DLLs while keeping the app…
AMSI39 The article shows a patchless AMSI bypass using Page Guard exceptions and VEH to intercept AmsiScanBuffer, force an early clean return, and…
Bypassing30 The article shows how attackers silence EDRs with firewall/WFP rules that block cloud communication, and how defenders can prevent or rapidly remove…
.NET50 The article presents Tenebris-Gate as a layered Windows Defender evasion framework using shellcode encryption, API hashing, anti-debugging, sandbox delays, syscall tricks, and…
Claude AI47 The article shows how Claude Code plus MCP can automate vulnerability hunting with RE, fuzzing, RAG, bounty scoring, and strict validation gates…
Claude AI22 Claude Code can speed up secure code reviews by mapping code paths, sources, sinks, and risky patterns, but it works best with…
EDR37 The article analyzes advanced techniques used to bypass EDR/XDR systems, showing how attackers combine evasion methods—such as indirect syscalls, ETW tampering, API…
Defender50 This vulnerability shows how Windows Defender file handling can be abused through filesystem races, Cloud Files APIs, and reparse points to redirect…
Bypassing444 COMouflage is a stealthy Windows injection technique that abuses COM DLL Surrogates to execute malicious DLLs inside dllhost.exe, making svchost.exe appear as…
EDR29 The article presents T(ROP)H, a process injection technique that hijacks threads and uses a ROP chain to load a DLL without allocating…
Active Directory30 Krb5RoastParser is a Python tool that extracts Kerberos authentication hashes from PCAP traffic and converts them into Hashcat-compatible formats, simplifying Kerberoasting and…
