thefLink retweeted
#x33fcon 2026 talks: @thefLinkk & Dominik Phillips: Fingerprinting Modern C2 Implants Through Runtime Telemetry > youtu.be/NtlRqdXaR7s
We are releasing Tracebit @x33fcon - a POC sensor aiming to fingerprint implants in memory
using only lowlevel runtime telemetry.
No signatures, no scanning. Only pagefaults.
github.com/threathunters-io/…
Excited to be speaking at @x33fcon 2026 alongside my colleague @dphillips__. We’ll be presenting “Fingerprinting Modern C2 Implants via Runtime Telemetry” and the tool we built as part of our research. See you there!
thefLink retweeted
Modern C2 implants use sleep masking & metamorphic code to stay hidden. We’re revealing how to unmask them using low-level runtime telemetry (ETW & CPU profiling) live in production including a POC with a lightweight sensor.
My team will be presenting our research at x33fcon:
x33fcon.com/#!s/SebastianFel…
As presented @x33fcon, this bigger update of Hunt-Sleeping-Beacons allows enumerating pending timers and their callbacks to identify timer-based sleepmasks.
Additional detection ideas included :-)
github.com/thefLink/Hunt-Sle…
Happy to present our team's research @x33fcon together with @CaptnBanana
We accidently built a Sysmon compatible tool with some neat features on top, like (in)direct syscall detection & more. Without drivers, with less resource footprint & using ETW only.
Curious? My team is presenting at @x33fcon in June.
Come & say hello!
x33fcon.com/#!s/SebastianFel…
thefLink retweeted
[RELEASE] EvtPsst a small mute tool developed by me, that abuses exposed SYNCHRONIZE and Token handles in order to get a process handle to the EventLog Process with more access.
Blogpost over the techniques will follow in the next days.
github.com/nothingspecialfor…
#redteam
Here is a little ETW based tool to play with different IOCs by ImageLoad events.
I feel like proxying Kernel32!LoadLibrary through Ntdll is a very strong IOC. :-)
github.com/thefLink/Hunt-Wei…
Here is a ETW based POC to monitor for (some) direct and indirect syscalls. Should find multiple open source implementations trying to avoid userlandhooks.
github.com/thefLink/Hunt-Wei…
Today we published a new tool to tamper with Sysmon.
Uses handle elevation and a SACL bypass to remain difficult to observe using Sysmon itself or Windows Event logs.
github.com/codewhitesec/Sysm…
Our powerintern @testert01 strikes again, teamed up with @thefLinkk and developed SysmonEnte: a hard to detect attack on Sysmon. Check out our new blogpost: codewhitesec.blogspot.com/20…
Added an attempt to detect suspicious and blocking callbacks of timers to Hunt-Sleeping-Beacons.
Probably detects some C2 using timer callbacks for sleep encryption
github.com/thefLink/Hunt-Sle…
Just pushed a detection idea for Foliage/AceLdr to Hunt-Sleeping-Beacons.
State Wait:UserRequest is triggered by KiUserApcDispatcher? Probably a Beacon :-)
github.com/thefLink/Hunt-Sle…
thefLink retweeted
As part of our #x33fcon talk, @invist and @theflinkk release a socks4a proxy leveraging PIC, Websockets and static obfuscation on assembly level 😎 Check it out: github.com/codewhitesec/Last…
thefLink retweeted
Our @thefLinkk and @TjarkRasche will give a workshop tomorrow at @bsidesbud on creating complex offensive tools as PIC. Come and learn about offensive coding techniques, memory artifacts and benefits of coding tools as PIC.
Here is my variant of Gargoyle for x64 to evade memory scanners. Fully relies on ROP and PIC without any APC.
Huge thanks to @waldoirc for the documentation.
github.com/thefLink/DeepSlee…
thefLink retweeted
the callstack scan was inspired by @thefLinkk's github.com/thefLink/Hunt-Sle… (mentioned in the code: github.com/hasherezade/pe-si…)
Here is another implementation of Hellsgate + Halosgate
It makes sure, that all resolved syscalls go through ntdll.dll by reusing syscall;ret instructions from clean syscall stubs.
github.com/thefLink/Recycled…
thefLink retweeted
.NET Remoting Revisited – playing around with .NET Remoting led @mwulftange to new insights, some enhancements for @tiraniddo's #ExploitRemotingService, a new universal #YSoSerialNet ObjRef gadget and its counterpart #RogueRemotingServer (1/2) codewhitesec.blogspot.com/20…
thefLink retweeted
We are going live tonight at 4 PM EST.
Season 5 episode 1 Tonight we gave a special guest @thefLinkk is going to present offensive PIC for red teamers.
patreon.com/MrUn1k0d3r
❤
#redteam #Pentesting
Here is an idea to identify running beacons:
1. Beacons ThreadState often is: DelayExecution
2. Calltrace to NtDelayExecution includes unknown regions
Works also fine against beacons sitting in file backed memory
github.com/thefLink/Hunt-Sle…