Research
Articles
LSASSEDR
Shadows of LSASS Dumping: Evasion Techniques and the Ongoing Struggle of EDR Solutions
Explores why LSASS is a critical target in Windows security, categorizing tools and techniques used to dump LSASS memory while evading detection.
Read on Medium
BYOVDKernel
BYOVD A Kernel Attack: Stealthy Threat to Endpoint Security
Dissects how BYOVD attacks blind, terminate, and manipulate EDR solutions — obtaining NT Authority context and removing EDR callbacks.
Read on Medium
Static Bypass
Arsenal 2.0: Elevating Malware Stealth Tactics to Bypass Static Detection
Advanced techniques for malware to evade static detection by EDR/XDR — an extension of the original Arsenal post diving deeper into new stealth approaches.
Read on Medium
PEB WalkIAT
PEB Walk: Avoid API Inspection in IAT and Bypass Static AV/EDR Detection
4-stage arsenal: hiding strings, obfuscating API imports, and resolving APIs dynamically via PEB walk to evade static analysis.
Read on Medium
AV/EDR/XDR
Arsenal: Bypass EDR's/XDR's and Make Malware Analysis Harder
Multiple techniques to bypass modern AV/EDR/XDR solutions, from a red team practitioner's perspective exploring new bypass methods.
Read on Medium
On-DiskSyscalls
On-Disk Detection: Bypass AV's/EDR's Using Syscalls with Legacy & NOP Instructions
Bypasses both static and dynamic AV/EDR detection, focusing on on-disk binary detection when using direct syscalls.
Read on Medium
UAC BypassDLL Hijack
EASE POST-EXPLOITATION: Elevated Shell via DLL Hijacking and Mock Directories
DLL Hijacking and Mock directories technique to bypass Windows UAC and obtain a high-privilege reverse shell.
Read on Medium
SyscallsKernel Mode
AV/EDR Evasion Using Direct System Calls (User-Mode vs Kernel-Mode)
How hooking is used by AV/EDRs to intercept function calls — and how direct syscalls bypass this interception at the kernel boundary.
Read on Medium
InjectionMimikatz
Bypass "Mimikatz" Using the Process Injection Technique
EDR and AV solutions commonly flag Mimikatz signatures. Covers process injection as a bypass — hiding execution inside a legitimate process.
Read on Medium
