Several common process tampering attacks exploit the gap between process creation and when security products are notified. Elastic Security detects a variety of such techniques, including Doppelgän...

This article introduces a previously-unnamed class of Windows vulnerability that demonstrates the dangers of assumption and describes some unintended security consequences.

Contribute to gabriellandau/PPLFault development by creating an account on GitHub.

This is the second in a two-part series discussing a still-unpatched userland Windows privilege escalation. The exploit enables attackers to perform highly privileged actions that typically require a...

Cobalt Strike 4.10 is live, with the new BeaconGate, post-ex kit, host rotation updates, a new jobs browser and more.

Intelligent search from Bing makes it easier to quickly find what you’re looking for and rewards you.

In this talk, we’ll uncover a previously-unnamed vulnerability class in Windows, showing how long-standing incorrect assumptions in the design of core Window...

In this research publication, we'll learn about upcoming improvements to the Windows Code Integrity subsystem that will make it harder for malware to tamper with Anti-Malware processes and other...

Contribute to gabriellandau/PPLFault development by creating an account on GitHub.

Let's discuss three benefits that Hardware Stack Protections brings beyond the intended exploit mitigation capability, and explain some limitations.

This blog is the first in a two-part series discussing a userland Windows exploit that enables attackers to perform highly privileged actions that typically require a kernel driver....

by splinter_code - 16 July 2020 Process Injection is a technique to hide code behind benign and/or system processes. This technique is u...

Keep it secret, keep it safe. Contribute to elastic/Silhouette development by creating an account on GitHub.

It's possible to reset the MEMORY_WORKING_SET_EX_INFORMATION.Shared bit, hiding the fact that a memory region is CoW. Microsoft accounted for this when implementing module tampering protec...

On Windows, each process has its own virtual address space. The CR3 value loaded into a logical processor is located inside of the KPROCESS structure...

Recorded Twitch livestream of ShmooCon 2023Schedule: https://web.archive.org/web/20230120215128/https://shmoocon.org/schedule/TIMESTAMPS0:00:00 Les Miserable...

Chapter 4. Tracing with BPF In software engineering, tracing is a method to collect data for profiling and debugging. The objective is to provide useful information at runtime for future … - Select...

https://www.offensivecon.org/speakers/2024/ian-beer.html

A tool to kill antimalware protected processes. Contribute to Yaxser/Backstab development by creating an account on GitHub.

"It's by design" is the phrase most bug bounty hunters see in their nightmares. It means the vulnerability they reported is (actually) a feature working as i...

Attached: 4 images Excellent work from @GabrielLandau on how Windows can be tricked into loading drivers with untrusted signatures: https://www.elastic.co/security-labs/false-file-immutability Repeat...

Recent advancements in OS security from Microsoft such as PatchGuard, Driver Signature Enforcement, and SecureBoot have helped curtail once-widespread commod...

This is the second in a two-part series discussing a still-unpatched userland Windows privilege escalation. The exploit enables attackers to perform highly privileged actions that typically require a...