Kurosh Dabbagh

nt authority\kurosh

[BlackArrow @BlackArrowSec]

All materials from BlackArrow’s talks are now available in our GitHub repository.

➡️ https://t.co/tf82hls411

[Kurosh Dabbagh @_Kudaes_]

I've released Puzzle, a research project on deploying malware in monitored environments by abusing Windows minifilters functionality. It includes several utilities and PoCs to interact with minifilters and explore static and runtime analysis evasion 👐

https://t.co/8zWv1g8n79

[EuskalHack @EuskalHack]

No te puedes perder a nuestro siguiente ponente, Kurosh Dabbagh, y su charla "Minifilters: Owning the High (and Low) Ground" en la próxima EuskalHack Security Congress IX @_Kudaes_ #ESCIX https://t.co/OGqYWOLVsP

[BlackArrow @BlackArrowSec]

Microsoft has addressed a one-click NTLM leak vulnerability affecting Windows Snipping Tool (CVE-2026-33829), discovered by our researcher Marcos Díaz (@Calvaruga).

➡️ Read the write-up: https://t.co/JvMGad5NuI
➡️ Microsoft bulletin: https://t.co/0IbpRxxUY7

[Kurosh Dabbagh @_Kudaes_]

@eldpit Siento mucho leer esto, mucho ánimo Rubén. NN es sin duda uno de los mejores congresos a nivel nacional, espero que se pueda restablecer el orden pronto.

[Wietze @Wietze]

Can LNK files ever be trusted?

⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself.

🐬 https://t.co/VZYVaEfO07

[Kurosh Dabbagh @_Kudaes_]

@Bad_Jubies 😂😂😂

[Kurosh Dabbagh @_Kudaes_]

Any good reading material on Windows Cache Manager, Memory Manager or I/O handling in general from the kernel's perspective?

[Kurosh Dabbagh @_Kudaes_]

@TheXC3LL Agree x10000

[X-C3LL @TheXC3LL]

A small rant:

The State of Art in Red Team is whatever you want to believe
https://t.co/ZihtNl8WEF

[_leon_jacobs(💥) @leonjza]

Available now at: https://t.co/CbRiCletuR

[Iago Abad @IagoAbad]

Hi! I just published a technical deep dive into a complex and fun N-day vulnerability that allows to get RCE in a very popular e-commerce platform.

Check it out!

https://t.co/DaZX3R6ob4

[Inés @ineesdv]

Tangled is a social engineering platform that weaponizes calendar event processing in Outlook and Gmail to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction.

https://t.co/vz4ulB2SL3

Technical breakdown: https://t.co/0Z0LH8hjdM

[BlackArrow @BlackArrowSec]

Meetings You Didn’t Plan, But We Did

In this post, @ineesdv breaks down how calendar event processing in Outlook and Gmail can be abused to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction

➡️Read more: https://t.co/7RApljHair

[klez @KlezVirus]

[RELEASE] As promised, I’m releasing the first blog post in a series. It covers the gaps still present in current stack-based telemetry and how Moonwalking can be extended to evade detection logic and reach “on-exec” memory encryption.
Enjoy ;)
https://t.co/4Yf28y7cT4

[BlackArrow @BlackArrowSec]

This Thursday, our colleague @_Kudaes_ will be at @NavajaNegra_AB presenting Activation Context Hijack: a new code execution technique for Windows environments.

➡️ More info: https://t.co/KLCb6lWNDw

[Kurosh Dabbagh @_Kudaes_]

@Samywithme Yes, admin privileges are required to open a handle to the disk

[Kurosh Dabbagh @_Kudaes_]

I just released MFTool, an NTFS parser that builds an in-memory map of a volume, allowing you to:
- Read any file without opening a handle
- Get the contents of locked/deleted files (registry hives, pagefile.sys, etc)
- Perform fast, in-memory searches across the entire disk
🔗👇

[Kurosh Dabbagh @_Kudaes_]

@shotgunner101 🫡!

[Kurosh Dabbagh @_Kudaes_]

@C5pider Thank you, man. I really appreciate it!

[Kurosh Dabbagh @_Kudaes_]

@TheXC3LL Thanks man! This one wasn't easy to pull it off 😅