Yazidou

Another infosec noobie | training @hackthebox_eu | | 🏴‍☠️

[Smukx.E @5mukx]

An unexpected journey into Microsoft Defender's signature World

Blog:- https://t.co/17xtrUXk1A

#windows #defender #reverse

[Connor McGarr @33y0re]

New exploit mitigation policy in the latest Canary build (ProcessBlockSmbNtlmPolicy? Not in the SDK, just what I'm calling it)! Like no child processes, managed via TokenFlags (not proc obj).

Currently not used anywhere. Presumably flags are for block/audit/allow? I don't know!

[ippsec @ippsec]

There is a lot of mythos hype and while I do think it will be better, I don’t think it will be orders of magnitude better or even proportional to its cost better.

At the end of the day, marketing is going to market. Everything I have read has been more exploits, not discovery. I think that word plays a big part but maybe I’m overthinking it.

I know of a lot of times opus (or a combo of models), can find an exploit, be confident it is valid, but fail at building an exploit due to a failed primitive (ex: kaslr in kernel bugs). Without that proof, it goes on the back burner decimating tokens until it hits the lottery. There’s so many vulnerabilities being found right now, it’s hard to prioritize when its severity is an assumption.

It’s probably been 6 months since the last major update, I’m guessing mythos knows more primitives. So when it’s launched it will look at notes left behind and get lots of credit when it worked off notes opus left behind and did a fraction of the work.

About the “it’s so dangerous” comments. I think that is primarily it not listening to the operator, doing things it shouldn’t to accomplish its goal. At that point it makes sense to do a closed beta, expand testers and try to make it obedient.

While that happens, cash in on publicity of doing the right thing and saying it’s too smart to go public. While true, it could be a little deceptive but as I said. Marketing is going to market.

[ς๏гєɭคภς0๔3г ([email protected]) @corelanc0d3r]

New Post: https://t.co/R86kfIdetp #corelan

[Mathieu Tarral @mtarral]

🚀 OSWatcher 0.6
Git Log is here !

Trace a <file / registry key / symbol / struct field> accross commits

Demo with _EPROCESS.Flags2 evolution ⬇️

➡️https://t.co/PeWLVBR60x

[vx-underground @vxunderground]

I've had so many people tell me to check out Claude. I tried it with my malware stuff (C WINAPI) and this thing produced some S-tier slop.

It produced incredibly dangerous, over complicated, or straight up incorrect work.

It did do a good job with API searching and stuff. Claude showed me some things I didn't know about. However, the implementation was wrong. I literally sent it a direct link to MSDN and it said, "You're absolutely right! My definition was wrong!".

Or I would ask it something about the Windows registry and it would just straight up hallucinate something about WoW64 redirection.

I suspect part of the problem is the lack of lower level C WINAPI documentation ... maybe? I don't know. High level stuff like Python it seems to do pretty good.

I've had so many people try to gas me up about Claude and AI. Dude, it's cool, I get it, okay? But it is still dangerous if you don't know what you're doing.

My best advice is to use AI to learn. Ask it questions. Study. Do NOT copy paste code from it.

[Souhail Hammou @Dark_Puzzle]

I've published the first entry in my new Windows vulnerability research series.

It details how exploring Windows I/O completion internals led to uncovering a use-after-free in afd.sys (CVE-2026-21241).

https://t.co/DwYlSpbGtL

[Back Engineering Labs @BackEngineerLab]

We’re releasing our analysis of https://t.co/cAmTrO7mvx, a major game cheat targeted by multiple studios in recent legal actions. We partially deobfuscated several Themida-protected components and document how it hijacks Hyper-V to inject and manipulate game code.

https://t.co/ykGrHdl6ty
https://t.co/LhEXxeIcnF

[vx-underground @vxunderground]

@DownWithUpSec This is fucking amazing work

https://t.co/Dnd3cqrCpv

[clibm079 @clibm079]

Revisiting MoonBounce: Research Notes
Technical Analysis and Design Insights into the DXE Core

https://t.co/wckznhGHJv

#MoonBounce #UEFI #CSM

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

I promise this is the last tracer I post (now I got everything covered that I usually analyze), but here is a little WinDbg driver tracer plugin I wrote to quickly analyze virtualized drivers. Logs module transitions, i.e. external function calls. :)

https://t.co/2zEaigtl7n

[Silky @S1lky_1337]

Dropping a new article.

It's about a new local privilege escalation technique that becomes viable when a writable system path is present. Yet another technique.

It uses Windows Audio for escalation and doesn't require system reboots.

https://t.co/sw9t5RKoMO

[Connor McGarr @33y0re]

[New @originhq blog+POC]

No PPL? No problem!

SecurityTrace, an undocumented ETW feature, restricts some AutoLogger traces to PPL only — yet we found this current design still allows non-PPL processes to consume from Threat-Intelligence as admin only!

https://t.co/iZyILtbJx8

[flux @0xfluxsec]

Etw, I barely even know her! If you want to follow my System Call Integrity Layer mini-project (and additionally maybe an Alt Syscall logging tool for researchers) - I have uploaded the initial commit to GitHub: https://t.co/VH18DM7OjA.

Video demo of the syscall logging module attached for SSNs for NtOpenProcess, NtAllocateVM, NtWriteVm and NtCreateThreadEx.

There is something special about writing a driver (in Rust) and getting no BSOD on the first test when dealing pool allocations across threads!

#blueteam #edr #redteam #cyber #cybersecurity #infosec #computing #kernel #driver #rust #rustlang #securityresearch #winternals

[Yazidou @xacone_]

@0xfluxsec @yarden_shafir Syscall Providers are unfortunately protected by PG (PspServiceDescriptorGroupTable). Tested on 25H2.

[Yazidou @xacone_]

@0xfluxsec @5mukx @jamieantisocial Me 😭

[Connor McGarr @33y0re]

Want to consume Microsoft-Windows-Threat-Intelligence but Antimalware-PPL getting you down? No problem! I will post a blog & POC soon - but this allows you to consume Threat-Intelligence without PPL _and_ w/o any kernel patching/driver loading gymnastics! Only need admin!

[Samuel Tulach @tulachsam]

Pong, but it's VBS enclave, but I bootkitted Hyper-V

https://t.co/rNKTTOaJcO

[Outflank @OutflankNL]

Let's play peekaboo with PatchGuard! Read our blog post about hiding processes on modern Windows systems with HVCI enabled:
https://t.co/8q7cAo6pSo

[Yazidou @xacone_]

@0xfluxsec Bro’s cooking 👨‍🍳