I played Google CTF 2021 Quals in zer0pts and I worked on several tasks. In the 6 pwnable challenges I solved during the CTF I liked "Full Chain" the most. This…

In our previous blog post “Detecting IcedID” we provided a global overview of the IcedID threat, its multiple stages and capabilities. This new blog post is focused on how to be proactive and hunt for IcedID DLL components to extract network IOCs. It will…

This workshop will go over the reverse engineering steps for looking at Cryptowall malware for the purposes of extracting information on the code injection technique in order to replicate for red team operation use.

Analyze patches in a process. Contribute to mike1k/HookHunter development by creating an account on GitHub.

Lateral movement refers to the behaviors of cyber attackers after gaining initial access to the assets and moves around the compromised network for sensitive data. The attacker will use different tools and techniques allowing them to move laterally through…

The recent release of PetitPotam by @topotam77 motivated me to get back to Windows RPC fuzzing. On this occasion, I thought it would be cool to write a blog post explaining how one can get into this security research area.

Our Director of Cyber Threat Research, Kev Breen, recently discovered a vulnerability in a piece of stalkerware. What...

Its been a few months since my last post about uploading and downloading data with certreq.exe as a potential alternative to certutil.exe in LOLBIN land. I've been having a blast starting my new role in the MDSec ActiveBreach team.

Today I wanted to share…

The Print Spooler is responsible to manage and process printer jobs. It runs as a service with SYSTEM level privileges on windows environments. Abuse of the Print Spooler service is not new and suc…

If someone wants to learn MacOS IR/forensics what’s the best resource for that? - macOS-IR-Forensics.md

Preface
(日本語版も公開されています。)
While PyPI has a security page, they don’t have a clear policy for vulnerability assessments.1
This article describes the vulnerabilities that were reported as potential vulnerabilities, using publicly available information. This…

Analysis and Exploitability of a buffer overflow vulnerability present in printer's drivers (CVE-2021-3438).

Techniques based on named pipes for pool overflow exploitation targeting the most recent (and oldest) Windows versions demonstrated on CVE-2020-17087 and an off-by-one overflow - vp777/Windows-Non-...

Our forthcoming paper is out! "Evasion and Countermeasures Techniques to Detect Dynamic Binary Instrumentation Frameworks" dl.acm.org/doi/abs/10.114…. A collaboration w. @ailtonTT and E. L. Feitosa [camera ready here: webdiis.unizar.es/~ricardo/files…] 🧵👇(1/6)

We dig into OSX.XLoader, also known as X Loader, which is the latest threat to macOS that bears some similarities to novice malware.

A general purpose memory allocator that implements an isolation security strategy to mitigate memory safety issues while maintaining good performance - struct/isoalloc