This blog covers Windows offensive security research - malware development, AV/EDR evasion, Active Directory attack chains, and red team tradecraft. What to Expect Category T...

A Note on Methodology The first three parts of this series are not attempts to demonstrate an EDR bypass. They are attempts to identify detection thresholds. Each test changes a single variable ...

Overview Part 1 tested the first detection assumption: Do the injection imports themselves trigger Defender? The answer was no. The binary was clearly identifiable as an injector from its im...

Overview The common assumption in offensive security is that using well-known injection APIs such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread is an immediate detection trigger. T...

Stealing Azure Tokens Without Touching Microsoft’s Authentication Infrastructure Persistent Tokens Multi‑factor authentication (MFA) is now standard. Password complexity policies are enforced. NT...

Overview Before you can bypass something reliably, you need to understand exactly what you are bypassing. This post uses Frida to trace the AMSI scan pipeline from inside a live PowerShell process...

AES Encrypted Shellcode This is to show how small changes made to malware can make a big difference. For example, when we create offensive tools that use known evasion techniques, if we ad...