nt authority\kurosh https://xitter.cf/t.co/MCEI38ndVE https://xitter.cf/t.co/w6aiUt7YlZ
Madrid
Joined January 2013
- Tweets2K
- Following198
- Followers1.5K
- Likes943
Kurosh Dabbagh retweeted
You don't need a USB. You need to look like one.
Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen.
DEF CON 34 talk w/ @Qm9yamFN.
Link at the first comment.
Kurosh Dabbagh retweeted
Ya se puede comprar Crónicas del Red Team en Popular Libros => popularlibros.com/libro/cron…
Kurosh Dabbagh retweeted
Evading Gatekeeper in enterprise macOS environments 🍎
In this post, @0xCappuCHINO covers a Red Team case study on macOS initial access, quarantine propagation behavior, and adapting payload delivery against built-in controls and EDR.
➡️ Read more: tarlogic.com/blog/macos-gate…
Kurosh Dabbagh retweeted
All materials from BlackArrow’s talks are now available in our GitHub repository.
➡️ github.com/blackarrowsec/tal…
I've released Puzzle, a research project on deploying malware in monitored environments by abusing Windows minifilters functionality. It includes several utilities and PoCs to interact with minifilters and explore static and runtime analysis evasion 👐
github.com/Kudaes/Puzzle
Kurosh Dabbagh retweeted
No te puedes perder a nuestro siguiente ponente, Kurosh Dabbagh, y su charla "Minifilters: Owning the High (and Low) Ground" en la próxima EuskalHack Security Congress IX @_Kudaes_ #ESCIX securitycongress.euskalhack.…
Kurosh Dabbagh retweeted
Microsoft has addressed a one-click NTLM leak vulnerability affecting Windows Snipping Tool (CVE-2026-33829), discovered by our researcher Marcos Díaz (@Calvaruga).
➡️ Read the write-up: github.com/blackarrowsec/red…
➡️ Microsoft bulletin: msrc.microsoft.com/update-gu…
Kurosh Dabbagh retweeted
Can LNK files ever be trusted?
⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself.
🐬 wietzebeukema.nl/blog/trust-…
Any good reading material on Windows Cache Manager, Memory Manager or I/O handling in general from the kernel's perspective?
Kurosh Dabbagh retweeted
A small rant:
The State of Art in Red Team is whatever you want to believe
x-c3ll.github.io/posts/Rant-…
Kurosh Dabbagh retweeted
Hi! I just published a technical deep dive into a complex and fun N-day vulnerability that allows to get RCE in a very popular e-commerce platform.
Check it out!
hiddeninslack.github.io/post…
Kurosh Dabbagh retweeted
Tangled is a social engineering platform that weaponizes calendar event processing in Outlook and Gmail to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction.
github.com/ineesdv/Tangled
Technical breakdown: tarlogic.com/blog/abusing-ca…
Kurosh Dabbagh retweeted
Meetings You Didn’t Plan, But We Did
In this post, @ineesdv breaks down how calendar event processing in Outlook and Gmail can be abused to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction
➡️Read more: tarlogic.com/blog/abusing-ca…
Kurosh Dabbagh retweeted
[RELEASE] As promised, I’m releasing the first blog post in a series. It covers the gaps still present in current stack-based telemetry and how Moonwalking can be extended to evade detection logic and reach “on-exec” memory encryption.
Enjoy ;)
klezvirus.github.io/posts/Mo…
Kurosh Dabbagh retweeted
This Thursday, our colleague @_Kudaes_ will be at @NavajaNegra_AB presenting Activation Context Hijack: a new code execution technique for Windows environments.
➡️ More info: navajanegra.com/2025/speaker…
I just released MFTool, an NTFS parser that builds an in-memory map of a volume, allowing you to:
- Read any file without opening a handle
- Get the contents of locked/deleted files (registry hives, pagefile.sys, etc)
- Perform fast, in-memory searches across the entire disk
🔗👇
Although direct access to disk is not new at all, especially when it comes to forensics, I think this approach could be useful in a number of contexts during a RT engagement.
github.com/Kudaes/MFTool
Kurosh Dabbagh retweeted
Exciting times. I'm publishing Dittobytes today after presenting it at @OrangeCon_nl !
Dittobytes is a true metamorphic cross-compiler aimed at evasion. Use Dittobytes to compile your malware. Each compilation produces unique, functional shellcode.
github.com/tijme/dittobytes