Panos Gkatziroulis 🦄

Red/Purple Teamer | Blogger | Ex-Director @pentestlabltd | Mod @ |

[0x12 Dark Development @Salsa12__]

Bring Your Own RWX Region DLL (BYORWXDLL)

New Medium post, today we are exploring a technique I call Bring Your Own RWX Region DLL, inspired by the well-known BYOVD (Bring Your Own Vulnerable Driver)

https://t.co/slNKv9qF4W

[Panos Gkatziroulis 🦄 @ipurple]

@0xBoku @HackingLZ @ShitSecure @claudeai @AnthropicAI Possibly true, you can’t trust anyone these days.

[Panos Gkatziroulis 🦄 @ipurple]

@HackingLZ @ShitSecure @0xBoku @claudeai In my personal experience, it requires some prompt adjustments first. Even with approval, it doesn't work by simply asking offensive security stuff directly.

[Panos Gkatziroulis 🦄 @ipurple]

@curi0usJack @cantcomputer CoPilot!

[Panos Gkatziroulis 🦄 @ipurple]

Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems https://t.co/j26UbHlFkd

[0x12 Dark Development @Salsa12__]

Classic Windows UAC bypass via computers.exe

[Panos Gkatziroulis 🦄 @ipurple]

I am wondering how many organizations have an effective Control Validation program?
Not considering run cases over BAS only, as BAS platforms are the tool, not the program.

[Panos Gkatziroulis 🦄 @ipurple]

Ledger - A Cobalt Strike aggressor script that tracks every operational change made during an engagement. ✅ Services
✅ Firewall Rules
✅ Accounts
✅ Registry keys
https://t.co/ybXV8uNKLS

[Panos Gkatziroulis 🦄 @ipurple]

Phantom Killer: Reverse Engineering and Weaponizing a Lenovo Driver to Terminate EDR Processes https://t.co/GugfBxVoV1

[Lefteris Panos @lefterispan]

Wrote a BOF that is able to execute .NET assemblies in-memory via module stomping so ETW / AMSI are seeing a legitimate GAC assembly instead - https://t.co/IimpD8aZ66

[Panos Gkatziroulis 🦄 @ipurple]

@Salsa12__ @EuroLeague I support ☘️, so I am with Real Madrid in this case 😃

[Panos Gkatziroulis 🦄 @ipurple]

Waiting for the @EuroLeague Final-4 games 🏀 to start, but until then lets start working on another technique for the https://t.co/YRMtBzvFVm blog.

[Panos Gkatziroulis 🦄 @ipurple]

https://t.co/yXFruE186G

[Panos Gkatziroulis 🦄 @ipurple]

New invite link for the Discord community just for 1 day (in the reply). Take advantage of these invites now.

[Panos Gkatziroulis 🦄 @ipurple]

goLoL - a Windows host scanner that finds LOLBAS binaries present on the current machine and lists techniques you can run at your current privilege level with MITRE ATT&CK mappings and example commands https://t.co/0CIRynqovI

[DebugPrivilege @DebugPrivilege]

Blog showing how AI, JavaScript browser automation, and Microsoft Graph API calls can be used to automate Entra ID tenant destruction and lockout’s. Ransomware, but for Cloud? 🫣 https://t.co/TRbHIt19en

[Panos Gkatziroulis 🦄 @ipurple]

CrabLoader - A PoC Cobalt Strike UDRL written in Rust https://t.co/GumBrbvH3i

[Panos Gkatziroulis 🦄 @ipurple]

@Kostastsale Good luck, and continue the good work with the platform and the cases.