Technical Writeups

Token impersonation from service accounts. Named pipes, SYSTEM connections, session isolation.

What attackers can do at user, admin, and SYSTEM levels. Where to hunt at each tier.

Why shortcuts no longer work for initial access. ISO, HTA, and MSI alternatives.

COM registration abuse. Squiblydoo, OCX droppers, and detection strategies.

Process tree manipulation, naming conventions, interval randomization, COM-based creation.

The difference between using tools and knowing why they work. PEB walking implementation.

Replace a legitimate process's code with your payload. PE parsing, NtUnmapViewOfSection, section mapping.

CreateRemoteThread + LoadLibrary. Why it's detected, what it teaches, and better alternatives including APC injection.

Registry hijack of HKCU ms-settings protocol handler. Medium to High integrity without a UAC prompt.

OpenProcess on winlogon, DuplicateTokenEx, CreateProcessWithTokenW. The Admin → SYSTEM chain in full.

Behavioral AV vs AMSI — why they're different problems. Sandbox detection, FUD loader design, PEB walking, XOR string encryption, memory-only execution.

Detecting Shodan, Censys, Infrawatch by IP range + payload signature. iptables PREROUTING redirect, auto-detection of unknown scanners, WHOIS-enriched alerts.

The migration protocol problem that breaks SYSTEM shells. Single-port fix, <<END>> sync, AES-256-CBC channel encryption, anti-sandbox timer.

SQLite Login Data + DPAPI + AES-256-GCM. How Chrome encrypts saved passwords and how stealers extract them.