Just dropped a deep dive on reversing ICMLuaUtil and uncovering the lesser-known CallCustomActionDll path for elevated DLL execution.
#ReverseEngineering #WindowsInternals #UACBypass
1
2
Search
From Zero to SYSTEM: Building PrintSpoofer from Scratch #PrintSpoofer #PrivilegeEscalation #WindowsInternals #MalwareDevelopment #EvasionTechniques
bl4ckarch.github.io/posts/PrintSpo…
2
330
From Zero to SYSTEM: Building PrintSpoofer from Scratch #PrintSpoofer #PrivilegeEscalation #WindowsInternals #MalwareDevelopment #EvasionTechniques bl4ckarch.github.io/posts/PrintSpo…
11
24
1.6K
PROCESS HOLLOWING EXPLAINED
Process hollowing lets malware hide inside a legitimate process. Understand each step to detect it in memory forensics.
#MalwareAnalysis #ProcessHollowing #WindowsInternals #DFIR #ThreatHunting
11
Windows API Arsenal — Updated
📚 256 APIs
🚥 Copy Signature
😮 31 Nt native APIs with syscall numbers
📌 Shareable links
🔍 Recent searches saved locally
[Use Desktop for Optimal View]
👉 blog.fautl.com/api-list
#ReverseEngineering #windowsinternals
3
18
75
3.5K
New post: deep dive into BEDaisy.sys, BattlEye’s kernel anti-cheat driver used in PUBG, R6 Siege, Escape from Tarkov, and more.
WinDbg output + annotated IDA pseudocode included.
s4dbrd.github.io/posts/reversin…
#ReverseEngineering #WindowsInternals #AntiCheat
7
44
190
11K
Windows Internals Part7: Exploring IO Stack Location
youtu.be/phGoHc_KuqM
#infosec #cybersecurity #windowsinternals
6
22
1.3K
Windows Internals Part6: Exploring IO Request Packet IRP
youtu.be/QK-79WFmpmI
#infosec #cybersecurity #windowsinternals
2
14
989
Windows Internals Part5: Exploring DEVICE_OBJECT
youtu.be/peYYfa7d0Zc
#infosec #cybersecurity #windowsinternals
14
52
3.1K
Windows Internals Part4: Create & Close Dispatch Routines
youtu.be/tWphAhOVZjU
#infosec #cybersecurity #windowsinternals
7
29
1.4K
Windows Internals Part3: Creating Device Objects & Symbolic Links
youtu.be/Ku550js2jQc
#infosec #cybersecurity #windowsinternals
16
72
3.2K
Windows Internals Part2: Exploring DRIVER_OBJECT structure
youtu.be/qbKV6UK5QCI
#infosec #cybersecurity #windowsinternals
8
55
2.7K
these are the 5 keys to the city:
Computer Management (compmgmt): The Master Dashboard. It’s where you schedule automated tasks, check the "security tapes" (Event Viewer), and manage your hard drive partitions.
#WindowsInternals #ITSupport #SystemsAdministration #CareerGrowth
1
3
Sharing for those who haven’t seen this announcement! Should be a great stream with the legend @zodiacon!
EDR internals and Rust, say no more, take my money!!
youtube.com/live/HtyQZBLzK…
#cyber #blueteam #windowsinternals #redteam #cybersecurity #infosec #winternals
15
53
6.5K
If you're interested in Windows kernel exploitation, there is a new technical post live on our blog
exploitpack.com/blogs/news/byp…
#WindowsInternals #KernelExploitation #CyberSecurity #VBS #HVCI #ReverseEngineering #ExploitDevelopment #MalwareAnalysis #RedTeam #WindowsKernel #InfoSec
3
6
387
Enumeration is not just a red team technique
It’s a defensive necessity.
Knowing what “normal” looks like is the foundation of detecting abnormal behavior.
Before using advanced tools, master the built-in ones.
#CyberSecurity #WindowsInternals #BlueTeam #RedTeam #EthicalHacking
12
Ever wonder who’s actually behind that "Are you sure?" screen that pops up when you try to install something?
Meet "consent.exe", the gatekeeper of your Windows administrative privileges.
medium.com/@boutnaru/the-…
#WindowsInternals #Security #UAC #TechDeepDive #DFIR
The Windows Process Journey — “consent.exe” (Consent UI for Administrative Applications)
“consent.exe” is the “Consent UI for Administrative Applications” which is called as part of a UAC (User Account Control) flow…
From medium.com 6
399
Meet the master architect of Windows sessions: smss.exe 🏗️
From initializing environment variables to launching CSRSS and Winlogon, it’s the first user-mode process to join the party.
🔗 medium.com/@boutnaru/the-…
#WindowsInternals #Security #OSArchitecture #DFIR #Forensics
The Windows Process Journey — smss.exe (Session Manager Subsystem)
“smss.exe” is the first user-mode process which is executed from %SystemRoot%\System32\smss.exe and it’s part of Windows since Windows NT…
From medium.com 11
1K
- Downgrading ci.dll and exploiting Windows Update (as demonstrated in a DEFCON session)
- Bypassing DES
- Bypassing Elastic and ETW-TI using a C2
- bypass EDR , MDE , win def
#Maldev #ExploitDevelopment #WindowsInternals #DEFCON #EDR #BYOVD #evasion
#ReverseEngineer #Redteam
1
10
609