We’re happy to announce that our EDR Internals & Development training is now in its final stages of development.
Over the past several months, an enormous amount of work has gone into building this highly technical & detailed training. The course covers the internals of modern EDR from both user-mode and kernel-mode perspectives, including techniques like syscall hooking, filesystem minifilters, ETW telemetry, memory scanning, kernel callbacks, process instrumentation callbacks, call stack tracing, and anti-tampering mechanisms.
The course concludes with building a limited yet functional custom EDR agent and we test it against several malware techniques to gain practical experience with detection engineering and EDR internals.
This huge undertaking would not have been possible without @GigelV41464 who dedicated countless hours to analyzing different EDR products, building custom implementations, analyzing internal mechanisms, and documenting the techniques with excellent depth and clarity.
The official launch date is scheduled for June 15, 2026 but starting today, we're opening access to an early bird discount of 20% for a limited time.
EDR Internals & Development: https://t.co/oN6qcMjLr2
We updated our Sliver C2 + BallisKit tutorial to adapt to the latest Sliver version.
Learn how to use ShellcodePack/MacroPack to harden Sliver implants and turn them into initial access payloads!
More C2 tutorials available on the blog (Adaptix, Mythic)
https://t.co/9B2trqBSyk
MAE focuses on practical, real-world offensive tradecraft including malwareless operations, tunnelling, AD CS abuse, cloud pivoting, and detection-aware operations.
Save 10% off MAE -
Discount code: LTR101-10Y
Valid until the end of August 2026.
Another Windows zero day released by Nightmare Eclipse (sort of)
It turns out Microsoft just straight up didn't patch an old CVE from 2020 correctly.
https://t.co/sNWBtTo4at
✍️ Yesterday, I wrote about EntryPoint Hijacking (a stealth process injection technique), including a proof of concept and a tool to detect this behaviour.
⬆️ If you want to elevate your detection approach and validate your defences, read the article.
The diagram below visualises the technique:
https://t.co/21D1KT2ozL
VulHunt by @binarly_io
https://t.co/ovsuyb5E26
Blog post series:
https://t.co/UzipgZw8la
https://t.co/F6E4OyqRAy
https://t.co/YG4tPvcDDt
https://t.co/24WivmtGZs
https://t.co/aGYL9HFo4B
#infosec
Silencing the EDR Silencers
Analysis of techniques to disable or silence EDR agents and some countermeasures, a post by Jonathan Johnson (@JonnyJohnson_ )
Source: https://t.co/9zEduFiN4S
#redteam#blueteam#maldev#malwaredevelopment
Built a custom version of Crystal Palace's linkserve. It adds an option to bind to 0.0.0.0 and takes an auth key in the HTTP request. Works great with Docker.
redStack is a Boot-to-Breach red team lab on AWS. Mythic, Sliver, and Havoc C2 behind a production-style Apache redirector. Deployed via Terraform, to be used for training/self hosted environments.
https://t.co/sEnzOIbaSi
BypassAV list
Map listing essential techniques to bypass anti-virus and EDR, in HTML and markdown format.
A post by matro7ch habibi.
Source: https://t.co/xnLu74dzQa
#redteam#blueteam#maldev#malwaredevelopment
Persistence Techniques That Persist
An overview of evolving persistence methods in malware and red team operations.
A post by Ari Novick.
Source: https://t.co/4ZjFy6u4Wi
#redteam#blueteam#maldev#malwaredevelopment
Mythic C2 on EarlyBird.
Leveraging Asynchronous Procedure Calls to execute memory-only shellcode within a legitimate process to avoid detection.
A post by Ivan Spiridonov (@xbz0n)
Source: https://t.co/Ru0iTMSMyV
#redteam#blueteam#maldev#malwaredevelopment