Susan Ghosh

Security Analyst and Researcher. Trying very hard to figure out C, Assembly and Windows Internals. Eternal N00b.🐶

[Joruno @wsl8297]

Windows 自带的任务管理器，日常结束卡死进程还凑合；但一遇到更深层的排障需求——比如线程死锁、被占用的文件句柄——就明显不够看了。

我在 GitHub 挖到一个开源利器：TaskExplorer。一款偏“专业级”的任务管理工具，不止看占用，更能把应用内部在做什么摊开给你看。

它主打高效的单窗口布局：点选进程，底部立刻呈现线程堆栈、内存编辑、文件句柄、网络 Socket 等关键细节，一屏把信息讲透。
实时刷新也很到位：磁盘读写位置、网络连接速率一目了然，甚至支持直接卸载或注入 DLL 模块。

GitHub：https://t.co/0ocoQJaLPY

项目基于 Qt 开发，底层用到 SystemInformer 的驱动技术；目前支持 Windows 7 及以上，后续还有移植 Linux 的计划。

如果你经常做系统级监控、性能定位、故障排查，这类工具会比传统任务管理器顺手得多。

[Nightmare Eclipse @ChaoticEclipse0]

Publicly disclosing the bluehammer exploit, at the time of writing this, this vulnerability is still unpatched.
Full PoC source can be found here -
https://t.co/yk80ylIfBV

[Gabriel Landau @GabrielLandau]

Step right up! 📢 We’re serving up a Windows kernel exploit that never goes stale. 🍿 Forget patches, this forever-day is popping off and it's here to stay. Grab a bucket and watch the show! https://t.co/E3zbarcY7L

[Origin @originhq]

Introducing Praxis, an adversarial framework for discovering, controlling, and orchestrating computer-use agents running on endpoints.

Announcement → https://t.co/hAPblR4rkp
Get Praxis → https://t.co/HFYJfspy3I

[Connor McGarr @33y0re]

Want to consume Microsoft-Windows-Threat-Intelligence but Antimalware-PPL getting you down? No problem! I will post a blog & POC soon - but this allows you to consume Threat-Intelligence without PPL _and_ w/o any kernel patching/driver loading gymnastics! Only need admin!

[Duncan Ogilvie 🍍 @mrexodia]

https://t.co/x8ky37TEwb

[Andrea Allievi @aall86]

https://t.co/txBlxmMa61 Anti-cheat evolution in Windows... New Year post while I am in vacation is ready!!! 🎉 Happy 2026!

[Connor McGarr @33y0re]

Starting 2026 with a new blog! I've really been enjoying my Windows on ARM machine - so my post is about interrupts for WoA. This includes x64/ARM differences, virtual interrupts, Hyper-V's synthetic controller, and Secure Kernel interrupts/intercepts
https://t.co/HvSbtsCtGu

[SAFA Team @SAFATeamApS]

Our team discovered CVE-2025-13032, an LPE in the Avast sandbox driver! Read the story of a SYSTEM token heist involving a break-in and escape from the antivirus sandbox. Full details: https://t.co/UzxwvrT3C1

#CVE #LPE #Antivirus #KernelExploit #WindowsSecurity

[x86matthew @x86matthew]

here's a small project i put together recently - a custom "bare-metal" protected-mode x86 NES emulator. it fits into 1MB RAM and loads ROMs from a floppy disk, no OS required. if you want to turn your old PC into an awkward NES clone with bad sound emulation then look no further.

[hasherezade @hasherezade]

New release: #TinyTracer v3.2 is out: https://t.co/qvbQqaUq16

[Mandiant (part of Google Cloud) @Mandiant]

Attention malware analysts 💻

Our latest blog post delves into Time Travel Debugging (TTD). We introduce the basics of WinDbg and TTD to help you start incorporating TTD into your analysis.

📄: https://t.co/07y5dniRy9

[Connor McGarr @33y0re]

Today I am releasing a new blog on Windows on ARM! It comes from the perspective of one, like myself, who comes from an x86 background and is new, but, interested in Windows on ARM! ELs, OS & hypervisor behavior (with VBS), virtual memory, paging, & more!

https://t.co/jUHls4wupu

[codewhisperer84 @codewhisperer84]

Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.

https://t.co/GC5wA2y3EO

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Panos Gkatziroulis 🦄 @ipurple]

Windows local privilege escalation through the bitpixie vulnerability https://t.co/sqyr3yz2uM

[x86matthew @x86matthew]

this is my short analysis of a little-known security feature built into Windows that inadvertently broke one of our authenticode signatures recently https://t.co/p7x4eg4OvR

[Mr.Un1k0d3r @MrUn1k0d3r]

You want to load your shellcode in .NET without calling VirtualProtect? Use RuntimeHelpers.PrepareMethod to create a predictable RWX memory region for you. This method also doesn't require a delegate function pointer, since you override a .NET method.
https://t.co/8oavXwyGEv

[Susan Ghosh @SubZero0x9]

A person with no coding experience can probably learn Rust faster than anyone having a ton of coding experience. Steep unlearning curve.

[Susan Ghosh @SubZero0x9]

#Rust borrow checker or "rust police" is 1000x worse than being in a toxic abusive relationship. Everytime you write something, you pray to the Rust gods that the borrow checker will accept it.The first week was horrible dealing with Rust. But compiler err messages are too good.