Win

I like Windows, Weather, Halo 5, and Live PD. Odd combination, but hey 👌 | Alt+F4 daily

[Brad Panovich @wxbrad]

My hurricane season PSA on long-range deterministic model posting. 7 days plus is fantasy land, as illustrated by last season's stats. Here's the verification that a storm actually formed when they show up at 168 hours out in both the GFS and ECMWF. GFS is a fantasy hurricane machine, and while the EURO is better, it is still not great for this time range. Patterns are good to look at, especially in the ensembles, but specific storm details are not. #tropics

[Visual Studio @VisualStudio]

C++ folks, rejoice 🎉
PackageReference is now in VS for C++ — cleaner deps, faster restores, zero clutter.
MSBuild-native + NuGet harmony = happy builds 😎

Dive in → https://t.co/1LcSRgVuWf

[Guy Leech @guyrleech]

When writing PowerShell scripts, always use full named parameters - DO NOT REPLY ON POSITIONAL PARAMETERS ! It makes scripts more difficult to understand and possibly go wrong if parameter positions change or you get them in the wrong order when writing.
This is an inconsistent example from a company called @Microsoft ☹️
At least it's not
$azcmagentPath = "$env:SystemRoot\AzureConnectedMachineAgent" , etc🙂

[Win @winlogon0]

@jesskavanaugh I know!!

[Mike's Weather Page @tropicalupdate]

Fire Danger levels bumped up for some today Wednesday. Areas in orange elevated. https://t.co/Hk3pbO7x8H

[Brad Panovich @wxbrad]

It's only March, but did you know we have the same sun angle as we do in early September right now? Plus, we are adding daylight at just over 2 mins a day, and here's a look at the next 6 weeks of sunniest and daylight length. #cltwx #ncwx #scwx #wcnc

[Win @winlogon0]

@wxbrad Love this graphic. SAVING

[EmersynMcKenzie 🎀 @OPLive_Kenz]

someone put their seatbelt on, that ding noise is annoying! more annoying than “your incident has been updated”! 😅 #OPLive

[Win @winlogon0]

@GreerPoplin @wxbrad It’s rather unreal the timing starting on Fridays for the last few as well

[Win @winlogon0]

@wxbrad Curious why they do this on Friday and Saturdays, or just coincidental the past few times?

[Dwight Corby @dwight_corby]

In case you were wondering, your incident has been updated. #OPLiveNation #oplive

[Win @winlogon0]

@bamaforlife01 lol

[Win @winlogon0]

@ettablue33 Retired

[Win @winlogon0]

@nickkoli07 😆😆😆

[Jiří Vinopal @vinopaljiri]

🧵 The Kernel Boot Blind Spot: Why EDR/AVs are "Brainless" in Phase 0 (SERVICE_BOOT_START)

If you think the Windows Registry is fully available when Kernel Drivers initialize, you’re mistaken. If you think the Filesystem as you are familiar with is fully initialized during the Phase 0, you’re mistaken. And judging by my recent Procmon boot logs (up-to-date Windows 11 25H2), even #Microsoft developers seem to forget this architectural reality.

1⃣ The Hive Gap
During Phase 0 (SERVICE_BOOT_START) and Phase 1 (SERVICE_SYSTEM_START), the OS Loader and Kernel only map the SYSTEM hive. The SOFTWARE hive and others? They don’t exist yet. They are physically on disk, but not mounted into the Object Manager namespace until smss.exe kicks in (Phase >1).

2⃣ The "NAME NOT FOUND" Wall of Shame
I boot-logged a fresh Windows 11 25H2 install (you can do too). The amount of Microsoft drivers (e.g., Ntfs.sys, Tcpip.sys, Fvevol.sys, Mup.sys, Crashdmp.sys, Netio.sys, Pacer.sys, etc.) spamming RegOpenKey on HKLM\SOFTWARE and getting NAME NOT FOUND is comical. They are blindly grasping for config keys that architecturally cannot exist yet.

3⃣ The EDR Constraint
This is exactly why AV/EDR vendors force their core config into the SYSTEM hive (usually under their Service key). During Phase 0, they have no Filesystem and no SOFTWARE hive. They are loaded, but they are operating in a limited standalone capacity.

4⃣ The "Golden Window"
Modern EDRs load their Kernel Filters at SERVICE_BOOT_START (Phase 0). But they are mostly passive monitors here—"look but don't touch"—because they lack the Intelligence provided by their User-Mode services (which don't start until Phase 2/Auto-Start).

5⃣ The Kill Chain
This creates a fatal architectural flaw. A malicious driver loaded at SERVICE_SYSTEM_START (Phase 1) can execute after the Filesystem is writable but before the EDR's User-Mode "Brain" starts.
You can surgically delete the EDR's service binaries from disk while its Kernel Filter is watching, effectively disarming it before it ever fully wakes up. The filter sees the IO, but without its User-Mode backend to provide heuristics or cloud verdict, it defaults to a fail-open state for signed drivers.

💡 TL;DR:
Phase 0/1 = No SOFTWARE Hive.
EDR Kernel Drivers = Awake but "Brainless."
Phase 1 Driver = God Mode for EDR Neutralization.
We all learned something today. Apparently, some MS driver devs need to learn it too. 😉

#WindowsInternals #KernelMode #EDR #AV #Infosec #ReverseEngineering #Bypass

[We don't deserve cats 😺 @catsareblessing]

He's deleting the entire world

[Wietze @Wietze]

Can LNK files ever be trusted?

⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself.

🐬 https://t.co/VZYVaEfO07

[Win @winlogon0]

@Gamecock_Scott Guess that was short lived?

[Win @winlogon0]

@davepl1968 Do you talk about what helped you anywhere by chance?