@pathtofile

Dad, researcher, and infosec psudo-specialist, posts and thoughts are my own. He/Him.

 Australia
blog.tofile.dev/
Joined October 2018
  • Tweets220
  • Following279
  • Followers453
3Media
Finally got a POC working. Working on a blog now, hopefully out in a couple of days 😀
Yarden Shafir@yarden_shafirSep 10
Some more details on WESP. Thanks @marcosd4h!
13
1
99
26,077
As powerful as various models are we have siems, edrs, and a stack of other products who detect/block all of this behavior.
4
5
1
30
3,060
Pat_H retweeted
RooCon@RooCon_AUJul 16
🚨 The Call for Proposals for RooCon26 is officially OPEN! 🚨 We want your best talks on threat intel & attribution for Nov 18-19 at Google Sydney. 🔒 Strict closed-door policy (no recordings/streams) 📅 Closes: Aug 31 Submit now: 🔗 rsvp.withgoogle.com/events/r…

RooCon26 CTI and Attribution Conference

RooCon26: Google backed Conference dedicated to putting the spotlight on the cutting edge of cyber threat intelligence and attribution.

rsvp.withgoogle.com
5
8
599
I like understanding how low-level technologies work and how they are used for platform security. I also enjoy building, breaking, and teaching these kinds of things. Check out my training class on them if you are interested: tandasat.github.io

System Programming Lab

The next public class is October 12 - 15, 2026 (8am - 4pm in PDT/UTC-7)

tandasat.github.io
cr3ghost
@cr3ghostJun 24
Satoshi Tanda found bugs in Microsoft's own Hyper-V hypervisor and HVCI implementation as a by-product of learning how they work. Let that sink in. His blog covers Intel VT-rp (the hardware defense Intel built to counter EPT-based hooking), kernel shadow stacks, SMM isolation, Hyper-V enforced security policies, and how he hunted down a HVCI bug in UEFI. His open-source projects include a hypervisor for stealth EPT-based kernel API monitoring (DdiMon), a UEFI hypervisor that boots a full operating system, minimal hypervisors for both Intel and AMD, and a full training course on building hypervisors from scratch for security researchers. DdiMon and HyperPlatform have been forked and adapted by game cheaters for years as the foundation for EPT-based hooking in the wild. The same code that was built for research became the backbone of an entire cheating ecosystem. If you are learning hypervisor development, Windows internals, or platform security, his work is where you start. Blog: tandasat.github.io/blog/ GitHub: github.com/tandasat Training: tandasat.github.io Author: @standa_t #WindowsInternals #ReverseEngineering #InfoSec
50
357
26,758
Replying to @dyn___
There’s no going back, the world of RE and VR has changed forever. The people who understand what they’re doing have become extremely productive.
4
6
57
9,758
Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why. r136a1.dev/2026/05/07/where-…

Where Have All the Complex Windows Malware and Their Analyses Gone?

You might have also wondered why, especially over the last few years, it has become increasingly rare to read about truly interesting malware and its in-depth analysis. If you’ve been in cybersecur...

r136a1.dev
20
130
12
587
84,487
Dear Network, I'm hiring a Cloud Security Researcher that wants to work at the forefront of investigating new cloud intrusions. You will bring a solid understanding of IAM. Using this knowledge you will dig through cloud activity logs (AWS CloudTrail, Azure Activity Logs) to find
1
3
4
520
Unprompted.au website is live and initial tickets are available: unprompted.au/

[un]prompted.au — AI × Cybersecurity Conference · Sydney, 18–19 September 2026

Two days of original vulnerability research, exploit development, and frontier AI security at ILUMINA, Sydney. Explore the program.

unprompted.au
15
7
27
25,257
Your BIOS is out of sight, out of mind: and that's exactly where attackers hide. Learn firmware security, SPI flash, SMM & how to RTFM like a pro. Architecture 4001: x86-64 Intel Firmware Attack & Defense by @XenoKovah is at ost2.fyi/Arch4001
5
28
1,713
The latest instalment of our VR Development Programme training material is available on GitHub now – learn the basics of reverse engineering! github.com/interruptlabs/VRD…
1
20
1
70
5,894
BITS & BOPS IS OUT NOW! 🎶 🎮 Over 20 original rhythm mini-games! 🎵 Catchy music! ⚡ Snappy gameplay! ✨ Gorgeous 2D animation! PLAY IT NOW ON STEAM! 💕
133
1,978
250
9,632
389,118
12 months ago I presented a 3 hour course on attacking and defending Microsoft IIS servers to a packed room at BSides Canberra, today the 30+ hour version went live on @XintraOrg !
inversecos
@inversecos14 Oct 2025
New XINTRA course‼️ Advanced IIS Post Exploitation, Detection & Evasion Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads. If your detection and response capabilities lag exposure, this course bridges the gap with: - Memory dump analysis (Windbg) - Deserialisation exploits & detections - ViewState attacks - .NET Reflection - Deobfuscation techniques Syllabus and preview videos here👇 xintra.org/courses/9-advance… @XintraOrg
3
14
1,757
A while back I was curious about the access check that occurs when someone tries to consume from the Threat-Intelligence ETW provider. I decided to write a short blog on the topic. jonny-johnson.medium.com/pee…

Peeling Back the Mask: How the Threat Intelligence Provider is Protected

Introduction

jonny-johnson.medium.com
22
59
10,252
🎉 RooCon25 is coming! 🎉 Join us on 5-6 November for our 3rd edition! As one of Australia's key cyber threat intelligence conferences, we're building on past success to make this our best event yet. Our Call for Papers opens in just one week! [1/3]
1
9
17
1,999
Normalize Conference Talks To Also Include Talks About Failed Projects and Failed Research Tell us stories of the journey and the struggles. None of us are perfect and We should stop admitting that we all haven't completely screwed up research.
15
11
1
100
7,927
Some personal news: I will be joining @Meta's security team (focusing on WhatsApp) starting next week. This is a big life change, I'm also moving to London permanently. I took this opportunity to reflect on the state of threat intel: blog.kwiatkowski.fr/threat-i… LMK if it resonates!

Threat Intel Truths Inside

Have you noticed it? There’s a strange melancholy floating about. Maybe it’s because major brands are being traded like Pokémon cards. Because some friends who are being laid off. Or even because the...

blog.kwiatkowski.fr
23
42
2
350
23,153
Heading to #OBTS v7? There are still spots open in iVerify researcher @Helthydriver's workshop on iOS threat hunting. Special Bonus: On day 3 of this training you will analyze an actual Pegasus case & learn the skills to dissect the Malware on your own. objectivebythesea.org/v7/tra…

#OBTS v7.0: Trainings

Learn from the top Apple security researchers in the world.

objectivebythesea.org
5
9
3,011
It’s wonderful to see what @XenoKovah and his collaborators have built for the community. I always recommend OST2 for my new hires and other juniors, or just anyone trying to get started on a new topic. The courses are excellent. It’s an honor to sponsor the Windows Security Path
OpenSecurityTraining2
@OpenSecTraining28 Oct 2024
Thanks to Winsider Seminars & Solutions (@yarden_shafir & @aionescu) for Sponsoring #OST2 at the Gold🥇 level! Learn more about them here: windows-internals.com/
15
113
16,730
I'll be running a free 3 hour training session at @BSidesCbr teaching people how to defend IIS servers by learning how to attack them. I'll be posting recommended host setups closer to the event so be sure to give me a follow. cfp.bsidescbr.com.au/bsides-…
4
7
548
Thanks @Bsides_BNE for letting me talk about why “Kernel ETW is the best ETW”. It’s not everyday that you get to talk about scripting a decompiler after watching a keynote from the mother of decompilers…
1
7
1
28
4,970
Load more