Ali Hadi | B!n@ry

DFIR and Adversary Simulation

| All posts reflect the views and interests of the person behind this account only |

[Ali Hadi | B!n@ry @binaryz0ne]

Please don’t lie to me… I can respect a bad decision you made, but I can’t respect a lier!

[Eric Zimmerman @EricRZimmerman]

1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)

✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less

Update with Get-ZimmermanTools 🧵 #DFIR

[Ali Hadi | B!n@ry @binaryz0ne]

@ClaudiaReznik Loved every word and thanks to the translator for helping someone like me to be able to read :)

[Ali Hadi | B!n@ry @binaryz0ne]

@ClaudiaReznik 👏🏻

It’s a warrior’s rest, not the end of the battle.

[DFIR Training @DFIRTraining]

Finding an artifact isn't the same as investigating a case.

Join Brett Shavers for a FREE live session examining how he develops questions, tests hypotheses, evaluates evidence, and makes investigative decisions in a real, ongoing case.

Oct 28 | 3:30 PM MT
https://t.co/8cZt3cwlcS

[Alexandre Borges @ale_sp_brazil]

Exploiting Reversing (ER) Series | Article 11: Windows: Missing Bounds in the Print Spooler.

The article has 60 pages, free. A user-mode target this time instead of a kernel one, worked end to end: from a missing bound check to a SYSTEM shell, with the service still running afterwards.

Published on:

https://t.co/VlebcByqKG

What it covers:

[+] The bug: a heap overflow (CWE-122) in the Print Spooler's form-enumeration path, reached
through InternalEnumForms → CopyIniFormToFormInfo → PackStrings → memcpy.

[+] It is still unpatched. I submitted it to Microsoft in March 2026 and MSRC assessed it as below the bar for
immediate servicing, because the PoC requires administrative rights. Re-confirmed working in October against current mainstream and Canary builds.

[+] The exploitation, which is two thirds of the article, with four stages: groom, corrupt, control, execute. The process never crashes: spoolsv.exe is left running and the planted form deleted.

[+] Important note: I had already notified the MSRC months ago that I would write an article about the vulnerability and publish it.

I would like to thank Ilfak Guilfanov ( @ilfak ) and Hex-Rays SA ( @HexRaysSA ) for the continuous
support.

This article will be published on https://t.co/GBDi0lO8Zd next week.

Hope you enjoy the read!

#Windows #PrintSpooler #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #HeapExploitation

[Florian Roth ⚡️ @cyb3rops]

Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:

1. Discovery with Nmap

Common and alternative web ports; HTTP headers that may expose PHP versions:

nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>

Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.

2. Huntress: Monitoring and detection

• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility

https://t.co/XLx8za50cZ

3. Vincent Schmalbach: Hardening and patching

• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise

https://t.co/30YfHmqIcR

Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.

[Andrii Bezverkhyi @andriinb]

An enterprise environment emits billions of log events every day. During an incident, the responder rarely needs all of them. They need the few hundred or thousands that tell the story: the burst of 4625 failures followed by a single 4624 success, the encoded PowerShell spawned by winword.exe, the new service installed at 03:12 on a domain controller. Logs analysis is the discipline of getting from the first number to the second fast enough to matter.

That job has become harder in two directions at once. Attackers using AI tooling generate evidence at machine speed and pad real actions with benign-looking activity. Meanwhile, the obvious shortcut of pushing logs into an LLM runs into guardrails, context-window limits and data-protection obligations. Hugging Face’s responders hit exactly that wall in July 2026, when roughly 17,000 , later to be claimed 3 billion events (still healthy daily workload) were refused by frontier models and had to be processed on a local model instead.

Below, we cover log analysis end to end, then look at LogTotal, SOC Prime’s free answer to the incident-time version of the problem. https://t.co/wZaxcJwecZ

[Ali Hadi | B!n@ry @binaryz0ne]

@MiaAI_lab For such a beast; I highly recommend you get the HS 420 from @HAVNGlobal . It’s the best case I’ve ever had+seen!

[Ali Hadi | B!n@ry @binaryz0ne]

Now they are over $8k !!!

[Ali Hadi | B!n@ry @binaryz0ne]

Wow these 5090s are ~7k! That’s crazy

[Phill Moore @phillmoore]

Week 41 - 2026 #DFIR

https://t.co/4o1MMnr1RM

[Alexandre Borges @ale_sp_brazil]

As I promised, Exploiting Reversing (ER) series: article 10 | iOS Security Research (part 01) is available on my blog now:

https://t.co/Y84wnZJxka

The primary source for new articles is https://t.co/VlebcByqKG, but articles will continue to be published on my blog with a one-week delay.

Enjoy the reading and have an excellent day.

#iOS #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #KernelSecurity

[Craig H. Rowland @CraigHRowland]

I'll be giving a webinar on Linux threats and going over our awesome new Sandfly 6.0 release. Check it out below and sign up to be the first to see what we have coming. We will be dropping massive threat detection upgrades that will be sending intruders running for cover!

[Phill Moore @phillmoore]

Week 40 - 2026 #DFIR

https://t.co/eyIELSR15T

[Ali Hadi | B!n@ry @binaryz0ne]

@donlacuta I’m glad they are useful 😊

[Ali Hadi | B!n@ry @binaryz0ne]

@Ox4d5a @_xpn_ Agree - just like "28 Years...."

[derek eiri 👻 @MrEerie]

Found Kevin S.' XWF (beta) X-Tension to load .DMG files!
https://t.co/q0GbtUNkTZ

[Ali Hadi | B!n@ry @binaryz0ne]

@thibautone My issue is with the weight. Lots of kids panic due to it being an exam and eventually they fail. So it will be harsh to judge their whole semester on those exams!

[Ali Hadi | B!n@ry @binaryz0ne]

If you’re a professor and your grading is:

10% quizzes
20% labs
70% exams

Please reconsider it.

A student’s entire semester should not be decided by 2–3 exams. Exams matter, but 70% is way too much weight for just a few days out of an entire semester.