cpp581 Exploring Protected Process Light and Exploits
Red team technique—process injection—and how to leverage it against Protected Process Light (PPL)
oxfemale·
Feb 2·
28 min
·581
// windows
198 postscpp581 
Bypassing379 Bypassing Image Load Kernel Callbacks
The post explores how Windows security products use kernel image load notifications to monitor when executables and DLLs are loaded by the system. These…
oxfemale·
Jan 30·
12 min
·379
Injection393 Mastering APC Injection with QueueUserAPC2
In this article, I will demonstrate one of the classic, fundamental techniques for injecting shellcode into a remote process using APCs. I…
oxfemale·
Jan 30·
14 min
·393
Audio416 DLL Hijacking in Windows Audio: A New Escalation Technique
Original post by S1lky This article describes DLL hijacking in the context of the audiodg.exe process which may load vendor-supplied APO-related DLL…
oxfemale·
Jan 30·
17 min
·416
Administrator381 Bypassing Windows Administrator Protection
Original text by James Forshaw A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of…
oxfemale·
Jan 30·
22 min
·381
winapi353 The Definitive Guide To Process Cloning on Windows
Original text by DENIS NAGAYUK & FRANCISCO DOMINGUEZ This article aims to provide the reader with a comprehensive guide to the technical details and…
oxfemale·
Nov 26·
28 min
·353