@MathildeVenault

Security researcher at @CrowdStrike, living off cheese and adventures. Opinions are my own.

Joined November 2019
  • Tweets58
  • Following203
  • Followers343
2Media
Thank you @reconmtl for this wonderful conference, what a way to discover Canada! Following up my talk, here are the slides & tool from the demo: github.com/MathildeVenault/T… Blogpost on @CrowdStrike's blog coming up soon!

GitHub - MathildeVenault/TheRestarter: Released alongside with a talk at REcon 2023, TheRestarter...

Released alongside with a talk at REcon 2023, TheRestarter is an interactive command-line tool is designed to interact with the Windows Restart Manager. - MathildeVenault/TheRestarter

github.com
2
18
44
13,813
Really excited to share on POC's stage not only one, but a whole new set of process injection techniques! 🇰🇷
POC_Crew
@POC_CrewSep 23
#POC2026 👁️ Mathilde Venault(@MathildeVenault) - “Off the Path: the Treasure Hunt for New Process Injection Techniques”
1
1
7
825
Mathilde Venault retweeted
POC_Crew
@POC_CrewSep 23
#POC2026 👁️ Mathilde Venault(@MathildeVenault) - “Off the Path: the Treasure Hunt for New Process Injection Techniques”
6
1
27
3,090
Mathilde Venault retweeted
Yarden Shafir@yarden_shafirJul 27
Very quick blog post to start the week: "enhanced session" shares your host clipboard with virtual machines, even if you didn't copy/paste anything from the VM itself. Might be common knowledge but it surprised me so I'm sharing it here windows-internals.com/random…
5
43
2
169
16,123
I was presenting this morning at @reconmtl my RE journey of the ClickOnce technology.. that led to discover a new abuse on it! If you've missed it, or are interested to learn about this little known feature, the research is also available on @CrowdStrike's blogspot below ☀️
1
9
24
3,515
Part 1: crowdstrike.com/en-us/blog/n…

New Abuse of the ClickOnce Technology: Part 1 | CrowdStrike

Learn how the ClickOnce deployment technology works, as well as its security implications in Part 1 of a two-part series.

crowdstrike.com
1
9
380
Part 2: crowdstrike.com/en-us/blog/n…

New Abuse of the ClickOnce Technology: Part 2 | CrowdStrike

In Part 2 of this two-part blog series, learn how threat actors weaponize ClickOnce features and how Falcon can detect and respond.

crowdstrike.com
6
268
Excited to return to @reconmtl in less than a month! This time, we’ll be peeling back the layers of the ClickOnce technology and exploring a few things that probably weren’t meant to be seen 👀 Détails & schedule to come: cfp.recon.cx/recon-2026/talk…
1
177
Mathilde Venault retweeted
Kyle Cucci@d4rksystem5 Jun 2025
I often am asked for pointers on building a VM for malware analysis. I wrote a 40+ page chapter on this in my book Evasive Malware. You can download this chapter from the book on my blog for free here: evasivemalware.com/EvasiveMa… Thanks @nostarch for allowing me to give it away 🤓
2
53
2
256
16,479
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir29 May 2025
Looks like @BlueHatIL talks are online now, so here’s my talk for anyone who wanted to learn about the latest episode of KASLR and couldn’t make it: youtu.be/Dk2rLO2LC6I

BlueHat IL 2025 - Yarden Shafir - Look, Ma—No Privileges! How Windows...

Look, Ma—No Privileges! How Windows Gives You Kernel Pointers (Even...

youtube.com
10
83
301
48,191
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir9 May 2025
FYI if you’re willing to link with ntdll or dynamically resolve it there’s a ton of APIs that return TEB/PEB or leave them in one of the registers. (Don’t believe official return values. MSDN is a liar!)
vx-underground
@vxunderground7 May 2025
Daax, being the traditional memesteroni he is, shared a cool proof-of-concept which demonstrates how to get a pointer to the Process Environment Block without using the GS and/or FS register. Look at the full thread. It's interesting.
3
36
1
271
29,903
WinDbg doesn’t have to win the battle!🧠💥 Join @MathildeVenault at SINCON 2025 for a hands-on reverse engineering workshop that helps you make sense of the Windows debugger. 📅22-23 May 2025 | 📍voco Orchard, SG 🎟️Pass: event.cybersecuritysg.com/39… #SINCON2025 #WindowsDebugging
2
1
263
Mathilde Venault retweeted
clearseclabs@clearseclabs17 Apr 2025
Upcoming public training: clearseclabs.com/#portfolio
1
1
201
Really excited to give a talk at SINCON this year! I'll be presenting my tool github.com/CrowdStrike/drawm…, that helps making the most of WinDbg in a minimum amount of time

GitHub - CrowdStrike/drawmeatree: Tool to visualize the output of the WinDbg "wt" command as...

Tool to visualize the output of the WinDbg "wt" command as customizable graphic trees, to facilitate reverse engineering. - CrowdStrike/drawmeatree

github.com
Infosec In the City (IIC)@Infosec_City11 Apr 2025
Join @MathildeVenault at SINCON 2025 to discover how DrawMeATree helps reverse engineers visualise & decode complex systems faster. 📅22-23 May 2025 | 📍voco Orchard, SG 🎟️Pass: event.cybersecuritysg.com/39… #SINCON2025
3
16
3,373
Mathilde Venault retweeted
Mari0n@pinkflawd26 Mar 2025
Save the date - @Blackhoodie_RE is partnering with @offensive_con this year to bring a BlackHoodie training to Berlin! Students will learn how to place compiler backdoors in innocent code. Mark your calendars for May 15th! Registration opens tomorrow, space is very limited ☺️
13
1
24
12,245
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir5 Mar 2025
I’m not saying you definitely have to go to @BlueHatIL this year, I’m just letting you know it’s free, by the beach and I’ll be there dropping kernel pointers to anyone who asks nicely
3
22
105
15,800
#CVE-2025-21419 2025-Feb Windows Setup Files Cleanup Windows Setup Files Cleanup Elevation of Privilege #ghidriff uncovering arbitrary delete vulnerabilities 👀 🔍 Patch introduced new function DeleteFileEx_MSRC. Not your typical function name... 🧐 A patch diffing 🧵...
2
10
26
2,771
Mathilde Venault retweeted
Connor McGarr@33y0re3 Feb 2025
Today I’m sharing a blog post on the implementation of kernel mode shadow stacks on Windows! This post covers actively debugging the Secure Kernel and also outlines why VTL 1 is relied on to help maintain the integrity of the supervisor shadow stacks! connormcgarr.github.io/km-sh…

Exploit Development: Investigating Kernel Mode Shadow Stacks on Windows

Using SourcePoint’s JTAG debugger to investigate the implementation of Intel CET Shadow Stacks in kernel-mode on Windows

connormcgarr.github.io
10
151
6
491
53,071
So glad to have been part of 44con this year!
44CON@44CON20 Sep 2024
Workshops in full swing for day 2 of 44CON ✨💻
5
313
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir14 Sep 2024
There’s a brand new conference which means you get another chance to take my Windows Internals class, this time in the US 😄 RE//verse, February 2025, Orlando Florida
RE//verse
@REverseConf13 Sep 2024
Replying to @REverseConf @securelyfitz @naehrdine @ElykDeer @palleiko @mr_phrazer
Uncover how GRU bootkits and PLA supply chain implants work in Yarden Shafir’s @yarden_shafir Windows Internals course. re-verse.io/windows-24/

RE//verse Training - Windows Internals for Security Engineers with Yarden Shafir

Covering Windows 11 “23H2”, the upcoming “24H2”, and Server 2022 and 2025, you'll unravel the secrets of how GRU bootkits, PLA software supply chain implants, NSA backdoors, and other kernel and...

re-verse.io
14
1
54
16,520
I'm happy to share that I'll be giving a workshop at @44CON about WinDbg, where I'll introduce a tool I've developed to make debugging much easier. Time to tame the Windows debugger together! 44con.com/44con-2024-talks-a…

44CON 2024 Talks and Workshops | 44CON

44con.com
1
8
42
5,533
Load more