Attack techniques, tooling breakdowns, and original research covering EDR evasion, Active Directory, Windows internals, and cloud security. Content you won't find elsewhere.
Shadow Credentials, AdminSDHolder backdoors, DCSync ACL delegation, Time Provider DLLs, AMSI Provider registration, Credential Provider DLLs — a complete reference of persistence vectors that fly under every defender's radar. Full implementation with commands.
How I built a 12-technique EDR bypass toolkit in C++17 and MASM. Covers AMSI bypass (3 methods), ETW patching, NTDLL unhooking via NtOpenSection, direct and indirect syscalls via Hell's Gate / Halo's Gate, process hollowing, module stomping, and sleep obfuscation.
Building a stealthy C2 channel using GitHub Gist as the communications medium. Operator console, implant beacon, command dispatching — all over the GitHub API. Traffic blends with normal developer activity. Plus OPSEC considerations and detection signals.
Full breakdown of the Entra ID attack surface — service principal abuse, OAuth2 consent phishing, app role escalation, conditional access bypass, PRT theft, and Cross-Tenant access abuse. How to find and exploit every misconfiguration a real engagement would target.