@TwoSevenOneT

Chief Security Officer (CSO) || Security Researcher at https://xitter.cf/t.co/YsorB5YEAu || Penetration Tester || Red Teamer || Social Engineering Awareness Trainer

zerosalarium.com
Joined September 2024
  • Tweets303
  • Following125
  • Followers5.5K
53Media
Using SendMessage with WM_SETTEXT, we can perform stealth injection and bypass EDR, even with high-end Endpoint Detection and Response systems 🛡️ Github: TwoSevenOneT/PhantomBuffer #CyberSecurityAwareness #Pentesting #redteam
PhantomBuffer edr evasion run success with high end EDR monitor

ALT PhantomBuffer edr evasion run success with high end EDR monitor

FindTargetWindows ultility in PhantomBuffer bypass edr tool kit

ALT FindTargetWindows ultility in PhantomBuffer bypass edr tool kit

3
45
1
239
8,292
PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response) #redteam #Hacking #Pentesting Detailed article: zerosalarium.com/2026/10/Pha…

PhantomBuffer: Effective EDR Evasion Through Stealth Injection

PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)

zerosalarium.com
5
1
23
1,375
The Rusty guys at Microsoft are messing around with WinDbg 🙃 After stopping the debugging process, the DbgEng engine fails to release all objects, preventing a second dump file from being opened. A golden rule: Always release what you allocate. While building an automated analysis tool, I spent the whole day scratching my head over this bug in the latest WinDbg version 🤯
Windbg leak - not release all handles after stop debugging

ALT Windbg leak - not release all handles after stop debugging

5
57
5,317
🥷 Now we can inject a payload into a remote process without using VirtualAllocEx and WriteProcessMemory. No need to suspend the target process New technique to evade EDRs: Github: TwoSevenOneT/InjectSetConsole #redteam #pentest #antimalware
10
189
4
996
59,871
InjectSetConsole performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs. #securityblog #cybersecurity zerosalarium.com/2026/09/edr…

EDR Evasion: Process Injection Without WriteProcessMemory

Technique performs Windows process code injection by leveraging a Windows named pipe, it does not use VirtualAllocEx and WriteProcessMemory

zerosalarium.com
1
12
1
80
7,684
PE‑OopsSec is a security utility designed to identify and flag common OPSEC mistakes hidden inside PE files Like this: E:\Movies\Action\Not_Porn\I_Swear_Its_Not\Why_Would_I_Lie\You_Have_Trust_Issues\Told_You_So\Empty_Folder\NASA_hot_kitten.jpg.pdb Github: TwoSevenOneT/PE-OopsSec #redteam #antimalware #pentest
PE-OopsSEC PECheck run demo

ALT PE-OopsSEC PECheck run demo

PE-OopsSEC PEHash run demo

ALT PE-OopsSEC PEHash run demo

1
25
160
12,795
PE‑OopsSec automating the detection of sensitive leaks: hardcoded paths, debug artifacts, or metadata that could expose operational details. Think of it as your safeguard against accidental disclosures #securityblog #cybersecurity zerosalarium.com/2026/07/pe-…

PE OopsSec: Mind your PE, guard your OPSEC

PE-OopsSec helps red teams, pentesters, and game developers give their payloads a final once‑over before putting them into the real world

zerosalarium.com
1
1
14
6,748
Been coding a lot with AI, so now I’m creating a toolkit (also AI‑assisted 😄) to check for OPSEC mistakes in PE files before they’re used in the real world. Both the article and the toolkit will be released soon 🤗
PE-OopsSec IAT check

ALT PE-OopsSec IAT check

PE-OopsSec Imphash check

ALT PE-OopsSec Imphash check

2
6
111
10,728
New #redteam tool for blocking EDRs: EDRChoker Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events #pentest #cybersecurity Github: TwoSevenOneT/EDRChoker
EDRChoker run throttling EDR process list

ALT EDRChoker run throttling EDR process list

Elastic EDR blocked by EDRChoker

ALT Elastic EDR blocked by EDRChoker

EDRChoker run remove throttling EDR process

ALT EDRChoker run remove throttling EDR process

24
178
9
757
122,167
EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them. #itsecurity #securityblog #altimalware zerosalarium.com/2026/06/edr…

EDRChoker: Choking The Telemetry Stream to Bypass Defenses

EDRChoker redteam tool uses Policy-based QoS - pacer.sys to set throttling on EDR agents, causing them to always time out, effectively blocking them

zerosalarium.com
1
26
1
109
20,004

Attack surface in the real-world environment of CVE-2026-41096 Windows DNS Client Vulnerability

Article · @TwoSevenOneT
3
39
3
139
42,178
Some powerful built-in Windows 11 programs are allowed to write files to Defender’s working directory: \System32\msiexec.exe \Register-CimProvider.exe \svchost.exe \lsass.exe Tools and methods to find these whitelisted programs for other #antimalware Github: /TwoSevenOneT/DefenderWrite
30
146
14,247
Challenge: Drop #mimikatz onto a drive with the latest Windows 11. 1. Found a way to write a file into Windows Defender’s working directory: Success ✅ 2. Dropped "mimikatz.exe" into that folder: Failed 🛑 Conclusion: Windows Defender does not exclude its own executable folder
11
53
9,389
While I was trying to evade cloud-based EDRs, I accidentally found a way to temporarily block a client's machine network with a POC running as a Normal user. Not using the Windows Filtering Platform (WFP) which requires Admin priv I haven't thought of exploitation scenarios for this tool yet, it might be a dead-end #antimalware research direction 🤔 #redteam
block a client's machine network with a POC running as a Normal user

ALT block a client's machine network with a POC running as a Normal user

3
31
162
17,132
Need to survey which Antivirus product to prioritize bypassing
vx-underground
@vxundergroundApr 18
Had a Threat Actor ask for an anti-virus recommendation DAWG, YOU ARE THE THREAT. WHY DO YOU NEED AN AV?
1
16
6,320
To be honest, in many cases I test evasion or antivirus bypass by dropping #mimikatz onto the Desktop and running it to see if it works. I don't use the EICAR test file 😂 Drop Mimikatz and the AV doesn't complain ==> something's worked
🥝🏳️‍🌈 Benjamin Delpy
@gentilkiwiApr 17
Want to feel #hacker but fear to put #mimikatz binary on your desktop?
5
5
79
16,270
They work harder than the sysadmin team to confige users' machines 🤣
blackorbird
@blackorbirdMar 11
BlackSanta EDR-Killer Operations github.com/blackorbird/APT_R…
1
3
19
7,333
Two Seven One Three retweeted
Mr.Z@zux0x3aMar 10
I am releasing a new toolkit I built for IIS-based lateral movement and code execution within IIS worker pool process's memory. Phantom ASPX Loader & PhantomLink -- a two-part toolkit for reflectively loading native DLLs into IIS w3wp.exe worker processes via ASPX. github.com/zux0x3a/Phantom/t…
4
78
247
16,988
Two Seven One Three retweeted
Tim Blazytko
@mr_phrazerMar 3
Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others. Here's the release: github.com/mrphrazer/binary-…

GitHub - mrphrazer/binary-ninja-headless-mcp: Headless Binary Ninja MCP server — giving AI agents...

Headless Binary Ninja MCP server — giving AI agents deep reverse-engineering capabilities via 180 tools. - mrphrazer/binary-ninja-headless-mcp

github.com
3
50
2
267
37,414
Load more