Red Team Engineering 2026

Info : https://nostarch.com/red-team-engineering

#redteam

Archive gems, don't bookmark.

#EDR

🔓 Dumping NTLM Hashes from Windows Memory via forensics tools
What can an attacker recover from a Windows memory image after gaining access to an endpoint?

In my new blog, I explored:
WinPmem → Volatility 3 → SYSTEM/SAM → NTLM

#RedTeam #OffensiveSecurity

You don’t always need to go for the hardest approach. Sometimes, you just need to understand what you actually need and choose the right path.

As you know, LSASS is heavily monitored and protected nowadays, so getting a dump from it isn’t as straightforward as it used to be.

So instead of getting stuck on LSASS and trying to bypass every protection around it, why not look at other options?

If the goal is to obtain local account credential material, SAM might be enough for what we need.

The point is simple: choose the technique based on the objective, not based on how complicated it is.

#EDR #SentinelOne

Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel”, presented at DEF CON 34 and BSidesLV 2026.

#EDR #maldev #defcon

Sam dumping using VSS COM Api

#sam #cred

Woooowwwww
You must Read this

https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline

#callstack #bypass