Dima van de Wouw retweeted
New video: basic reversing of a Windows kernel driver.
WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port.
Full write-up: trainsec.net/library/malware…
Dima van de Wouw retweeted
Your MCP server works fine, but the agent can't find a tool, ignores your constraints, or misses key output. Why?
The client decides what the model sees. We dug into Codex and Claude Code to find out what they truncate, change, or drop entirely. ow.ly/h7L750ZTvaF
Dima van de Wouw retweeted
Guess what... @fortraofficial / @_ZeroPointSec are looking for a new content developer to join our ranks.
fortra.wd12.myworkdayjobs.co…
Dima van de Wouw retweeted
A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.
Dima van de Wouw retweeted
How do you run your own service inside Svchost.exe?
trainsec.net/library/malware…
Dima van de Wouw retweeted
Latest preview build (29661) ships wesp.sys! The long-awaited initiative that should make it easier for EDRs to move capabilities to user mode and stay more resilient against kernel-level attacks.
Dima van de Wouw retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
Dima van de Wouw retweeted
Had a blast working with my buddy @max__grim creating this badge! Thanks to @OutflankNL and @MDSecLabs for the conf. It was a blast again ❤️ Looking forward to the next one!
Infosec tradecraft just became reusable by AI agents.
SpecterOps just open-sourced:
79 skills.
22 reusable agents.
26 plugin families.
BloodHound. Cobalt Strike. Outflank C2. Ghidra. Binary Ninja. Ghostwriter. Recon. AppSec. Code review. C2 development. Reverse engineering. Adversary simulation. Windows + macOS tradecraft.
And this is NOT just for red teamers.
Vulnerability researchers:
These workflows could accelerate code review, patch analysis, 1-day research and potentially help with 0-day discovery when paired with real research expertise.
Reverse engineers + malware analysts:
Give agents structured workflows, references and tooling instead of starting every investigation from a blank prompt.
Blue teams + detection engineers:
Study the same offensive tradecraft, emulate attacker behavior, build better detections and start asking what telemetry survives increasingly agent-assisted operations.
DFIR + threat intel:
Understand what adversaries may automate next and turn repeatable investigative knowledge into reusable workflows.
Red teamers:
BloodHound attack paths, recon, C2 development, adversary simulation and operator tradecraft are becoming increasingly agent-assisted.
This isn't another collection of AI prompts.
It's practitioner knowledge being turned into reusable, reviewable security workflows.
Potentially useful for everyone from CTF learners and newcomers all the way to malware analysts, reverse engineers, exploit devs, red teams, blue teams and vulnerability researchers.
This is only the beginning.
@SpecterOps Skills:
github.com/SpecterOps/skills
@OutflankNL and @kyleavery breakdown:
outflank.nl/blog/2026/09/02/…
#Infosec #RedTeam #ReverseEngineering
Dima van de Wouw retweeted
RedTreat #5 is a wrap, possibly the best one yet! Awesome talks, attendees and location ❤️ safe travels to all attendees from me, @MarcOverIP and @StanHacked
Dima van de Wouw retweeted
I just released the first public version of @BintracerLabs, a malware-analysis sandbox focused on macOS.
Bintracer can:
- Detonate Mach-O binaries, app bundles, and dylibs
- Extract DMG and PKG files
- Analyze JXA, AppleScript, Python, Perl, and shell scripts
This project is still early, but I can't wait to see what y'all think!
Dima van de Wouw retweeted
Ever wondered how an external developer can work with Outflank to get their tool into OST? We explore the process of incorporating infraRED, which can be used for auto deployment of RT infra (c2, redir, multi cloud, domains, email).Big thanks to @dsec_net! shorturl.at/VSd8a
Dima van de Wouw retweeted
New video: Process Memory Map in Code (Part 2).
MemMap now identifies the file behind a mapped or image block with GetMappedFileName. Turns out Windows hands that back as an NT path, not “DOS” path, so I build a conversion function.
Full write-up: trainsec.net/library/windows…
Dima van de Wouw retweeted
Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway.
New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks.
Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇
mrtiz.github.io/cet-callstac…
Dima van de Wouw retweeted
Wrote a blog post about abusing signed Google Chrome installers to achieve arbitrary code execution
blog.amberwolf.com/blog/2026…
Dima van de Wouw retweeted
Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations.
An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed.
research.checkpoint.com/2026…
Dima van de Wouw retweeted
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet.
Now you can. Enjoy!
netspi.com/blog/technical-bl…
Dima van de Wouw retweeted
I've been fairly quiet about recent events for good reasons, but this popped up on my radar - netspi.com/mdsec-security-al…
I don't have much to say except some companies will forever lack class. For anyone looking for a new pentest, red team or c2 product vendor, there are many great ones out there and do your homework - the ones I am personally familiar with and would wholeheartedly recommend are @AmberWolfSec, @remotethreat, @SpecterOps, @OutflankNL and @TrustedSec ❤️
Dima van de Wouw retweeted
New video: VMMap Basics.
128 terabytes of address space on 64-bit Windows, and almost none of it used. VMMap shows you what's actually committed and why: images, heaps, stacks, and more.
Full write-up: trainsec.net/library/windows…
Dima van de Wouw retweeted
New blog
Spent way too much time reverse engineering CrowdStrike Falcon.
Somewhere along the way, I found a bug. It's low and not practically exploitable... but a bug is a bug :)
Publishing soon
0xdbgman.github.io/posts/ins…




































