@waldoirc

Trying to figure out how computers work. Figuring out SDR, IOT, and Mobile exploitation. https://xitter.cf/t.co/rLZFU0dOBy

 United States
arashparsa.com
Joined March 2019
  • Tweets604
  • Following615
  • Followers3.9K
19Media
Replying to @KlezVirus
@KlezVirus and I got a Defcon talk accepted. We will talk about stack spoofing techniques we made with our friend @trickster012 and based on research from @namazso. Hope to see you there!
11
14
2
118
28,855
waldoirc retweeted
5pider
@C5piderFeb 21
Havoc Professional Finally Released! 🕸️🕷️ Since our last blog post introducing the Havoc Professional framework and the Kaine-Kit, we've been refining the framework behind the scenes while also welcoming @avx128 as a new member of our team. This blog post covers the numerous features included in the initial release of Havoc Professional. I'm excited to finally share the work my team and I have put in over the past year. This is just the beginning of what we have planned. infinitycurve.org/blog/relea…

Havoc Professional Release

The initial release of the long awaited Havoc Professional and the Kaine-kit is finally here and new team member.

infinitycurve.org
29
73
4
340
43,496
waldoirc retweeted
Arun@dazzyddosJan 8
Wrote a short blog post on how we pivoted from a windows workstation to AWS on a recent engagement via IoT greengrass. Do not worry, in the post I do not ask to "touch grass" lol :P medium.com/seercurity-spotli…

From Edge to Cloud: Pivoting to AWS via Compromised IoT Greengrass Devices

TL;DR

medium.com
1
9
16
1,415
I’ll be teaching how EDR REALLY works this Friday at BSIDES NOVA bsidesnova-2025.sessionize.c…. It’ll be a medium level course where we analyze malware and its telemetry found in EDR, then try to build hunts around it. Great for attackers and defenders. Hope to see you there!
7
44
4,894
This is my research project in creating read, write and allocate primitives that can be turned into an injection in order to evade certain telemetry which I presented last year in RedTreat. I hope everyone likes it \m/. trickster0.github.io/posts/P…

Primitive Injection - Breaking the Status Quo

It has been a while, this is my research on trying to change the IOCs of a common remote process injection flow and the end result. I presented this in RedTreat in 2024 and I thought it was about...

trickster0.github.io
6
91
1
260
33,032
The code and tutorials are here if the link doesn't work! 😒 github.com/google/security-r…

security-research/pocs/cpus/entrysign/zentool/docs/intro.md at master · google/security-research

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code. - google/security-research

github.com
3
21
2
137
18,980
waldoirc retweeted
T3nb3w@T3nb3w2 Mar 2025
🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research! 🔍 Blog: mohamed-fakroud.gitbook.io/r… 💻 Code: github.com/T3nb3w/ComDotNetE…

Abusing IDispatch for Trapped COM Object Access & Injecting into PPL Processes | Red Teaming's Dojo

mohamed-fakroud.gitbook.io
7
164
2
422
52,448
Alerts will always only be as useful as the analysis that goes into them as well. If alerts get ignored or get marked as FP trivially by teams, it’s as good as the alert never having existed in truth. AV just blocks but EDR needs analysis.
2
9
1,619
waldoirc retweeted
Joe
@trk_rdy4 Dec 2023
Quarterly reminder that Defender for Endpoint (MDE) is not EDR. MDE is a logical grouping of many protections, EDR being one of the them. That is all.
2
4
1
24
7,366
Call Stack Spoofing for beginners, by @d_tranman #redteam dtsec.us/2023-09-15-StackSpo…

An Introduction into Stack Spoofing

And losing my sanity against Elastic

dtsec.us
84
232
24,855
Here is a little ETW based tool to play with different IOCs by ImageLoad events. I feel like proxying Kernel32!LoadLibrary through Ntdll is a very strong IOC. :-) github.com/thefLink/Hunt-Wei…

GitHub - thefLink/Hunt-Weird-ImageLoads: Small tool to play with IOCs caused by Imageload events

Small tool to play with IOCs caused by Imageload events - thefLink/Hunt-Weird-ImageLoads

github.com
1
43
125
19,720
waldoirc retweeted
Fabian@testert0129 Oct 2023
[Blogpost] EvtPsst a small EventLog Process Mute tool without OpenProcess call to the EventLog process. This blog shows how to elevate a SYNCHRONIZE handle to a full process handle with a process token of EventLog. nothingspecialforu.github.io… #redteam

testert01 Blog

nothingspecialforu.github.io
1
34
56
8,984
waldoirc retweeted
T3nb3w@T3nb3w18 Oct 2023
Just published a blog on the House of Force heap exploitation technique! Learned a ton about glibc's ptmalloc. Check it out! #HeapExploitation #vulnresearch mohamed-fakroud.gitbook.io/r…

Heap - House Of Force | Red Teaming's Dojo

mohamed-fakroud.gitbook.io
1
26
88
9,771
Being in this class is blowing my mind! The material is amazing and the instructors are crushing it. If you're interested in attacking AI/ML, you have to check out this course!
moo
@moo_hax8 Aug 2023
Students are crushing the Blackhat Machine Learning training! Gave students a cool book from @EdwardRaffML, environment was Mythic by @its_a_feature_ (AI + C2 = ❤️). Tradecraft lessons from @drhyrum @ram_ssk and @NMspinach Forged by @josephtlucas @ColdwaterQ @rharang If you want the tldr… youtu.be/fpWbMp6jz0U #BlackHat2023
3
6
31
9,412
The new Token Universe v0.5 can view and edit security descriptors on 30 types of securable objects. 🔥 It also knows how to handle complex ACLs with compound and callback ACEs, mandatory and trust labels, and more. Enjoy experimenting! github.com/diversenok/TokenU…
2
31
73
12,009
Daily reminder that EDR is not AV and requires manned hunters to be effective (which is why they provide hunt portals). Bypassing or using only built in EDR alerts means you’re both doing it wrong. Theres a lot of telemetry here and hunting can be strong.
5
8
46
13,427
I should elaborate. EDR needs manned hunters OR custom made alerts. I think everyone assumes I ONLY mean hunting. Certainly not. My point is, EDR IS NOT leave it and forget it for the most part.
2
1
1
6
1,866
waldoirc retweeted
Macmod@MacmodSec8 Apr 2023
Replying to @lapinousexy @waldoirc
No amount of R&D is enough in security. If you have a quick look at most TTPs you will realize that most EDRs will cover most of the most dangerous ones, but will leave lots of gaps. Good examaples would be malicious browser extensions which most EDRs don't inspect properly.
2
1
7
1,043
waldoirc retweeted
john@turboCodr10 Jan 2023
About 5 years ago I started wondering if a malware C2 channel existed that embedded messages and data payloads inside the x509 cert used for the TLS handshake. I searched but never found this in the wild so this year I decided to write it myself. github.com/jconwell/secret_h…

GitHub - jconwell/secret_handshake: A prototype malware C2 channel using x509 certificates over mTLS

A prototype malware C2 channel using x509 certificates over mTLS - jconwell/secret_handshake

github.com
4
85
4
291
50,182
New year, new tools! As part of my #KernelKarnage talk at @SANSOffensive #SANSPenTestHackFest back in November I'm happy to release: The CobaltWhispers Framework & Interceptor Kernel Driver! github.com/NVISOsecurity/Cob… github.com/NVISOsecurity/Int…

GitHub - NVISOsecurity/CobaltWhispers: CobaltWhispers is an aggressor script that utilizes a...

CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls (SysWh...

github.com
2
60
1
140
19,943
Everyone is playing with OpenAI for offense but it doesn’t seem horrible at describing scenarios for defense either. You should probably take what it says with a grain of salt but….not bad. (And don’t forget every environment is different).
1
11
Another:
1
2
One more:
2
Load more