Vithor

Just a simple guy. 🇧🇷

[Bezu @obezumiya]

https://t.co/PacP3qMgoq

[Vithor @m3mdump]

@obezumiya kkkkkkkkkkkkkkkkkkkkkkkkkkkkkk perdi 3 horas da minha vida tentando fazer essa porra, vai lá o detrolas e me molesta!

[Smukx.E @5mukx]

I explored the windows global device identifier (GDID) and wrote a poc, including a BoF to extract it. But the main question is: Can we patch another user's GDID ?

Repo (coff BoF, Rust/C PoC) :- https://t.co/0RFJM9b2Ty

Read the full Research here:- https://t.co/7kbcN1Iwqz

[cr3ghost @cr3ghost]

A single bit flip in kernel memory can completely disable an ETW provider. No crash. No alert. The EDR just stops seeing events.

This post walks through every telemetry source EDRs rely on and how each one works at the kernel level. ETW providers, driver callbacks, object callbacks, registry callbacks. The kernel structures behind them, how to find them in memory with WinDbg, and what an attacker can manipulate.

Hidden ETW providers invisible to user-land enumeration. Zeroing callback arrays to blind Sysmon. Loading DLLs without triggering image load notifications. Executing payloads through fibers without generating thread creation events. Flipping single bits to disable monitoring entirely.

If you are building detections, you need to understand what telemetry you are trusting and how easily it can be taken away from you.

https://t.co/goGWmbLxpy

Author: @OtterHacker

#DetectionEngineering #WindowsInternals #InfoSec

[Abdelhamid Naceri @MSNightmare2000]

I spent countless nights thinking about it, I did everything to make you happy, what did I do to deserve such cruelty ?