Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.
MacNoise is a modular, open-source macOS telemetry noise generator built to help defenders validate EDR, SIEM, and firewall detection coverage by emitting real system events — network connections, process spawns, dylib injection, file writes, plist mutations, TCC permission probes, and launch agent persistence. It ships a REPL (macnoise run/list/info/scenario), a dry-run testing mode, and OCSF-compliant JSONL audit/telemetry logs tagged with MITRE ATT&CK mappings and correlation IDs, and supports YAML "scenarios" that chain modules to emulate specific adversary tradecraft (e.g., an EDR Validation Suite covering proc_inject, net_dns, tcc_fda). It's positioned as a macOS-focused complement to the EDR-Telemetry project and Windows-centric atomic-testing tools, aimed at surfacing logging gaps before an incident.
A reverse-engineering walkthrough of qwinsta.exe showing it uses the undocumented WinStation API (winsta.dll) — WinStationOpenServerW, WinStationEnumerateW, WinStationQueryInformationW — rather than the documented Terminal Services (WTS) API used in harmj0y's prior PowerShell approach. The author demonstrates that remote session enumeration via these APIs succeeds against a target host even when Remote Desktop is disabled, and provides C++ code to load winsta.dll, resolve the undocumented function pointers via GetProcAddress, and parse the resulting byte-array structures to extract usernames and session state.
A technical deep-dive into Windows Protected Process Light (PPL) and its role protecting lsass.exe from memory access/code injection by non-protected processes, walking through the LSA protection hierarchy, registry (RunAsPPL) and GPO configuration, and the author's journey toward exploiting/disabling PPL protection using kernel driver techniques inspired by prior work like Mimikatz's driver. It covers Microsoft's official protections (KB guidance, UEFI lock/Secure Boot) and practical notes on why lsass.exe dumping fails at the kernel level versus EDR interference.
Walkthrough of a Windows privilege escalation and persistence technique credited to Grzegorz Tworek: from a compromised admin account, running `sc.exe sdset scmanager D:(A;;KA;;;WD)` grants the Everyone group full control over the Service Control Manager, letting any non-privileged user create a SYSTEM-context service (e.g. one that adds their account to local Administrators) that persists across reboots even if admin rights or the service are later removed. The post breaks down the SDDL security-descriptor syntax used in the command and provides a Sigma rule to detect the sdset DACL modification via process-creation logs.
WindowsSigmaPowerShell
Grzegorz Tworek
Offensive Security, Blue Team & Detection· 2023-02-27T00:00:00+00:00
A TryHackMe 'crackme8' walkthrough that reverses a 32-bit ELF binary using GDB (with pwndbg) to bypass two comparison checks in main() and reach the giveFlag function. The author sets breakpoints, disassembles in Intel syntax, and patches the EAX register live (set $eax=3405705229) to satisfy a hidden magic-number check (0xcafef00d) after passing an argument-count gate, ultimately printing the flag.
Part 2 of a TryHackMe ELF reversing series that solves two crackme challenges: Crackme5 uses ltrace to observe strcmp/strlen library calls and leak the plaintext password directly from traced output, while Crackme6 uses Binary Ninja's graph and pseudo-C views to trace a compare_pwd/my_secure_test function, reconstruct byte-by-byte hex comparisons, and convert them to ASCII to recover the password. It's a beginner-oriented walkthrough demonstrating basic static/dynamic binary analysis workflow and tooling (ltrace, Binary Ninja, mov/test/je instruction reading).
A walkthrough of four TryHackMe "crackme" ELF reversing challenges, progressing from simple execution and `strings` analysis, to decoding a base64-encoded password, to using GDB with the pwndbg plugin to set a breakpoint at `strcmp@plt` and read the hidden password directly out of the RAX/RDI registers. It demonstrates basic static (strings, chmod +x) and dynamic (disassembly with `disass`, breakpoints, register inspection) reverse-engineering workflow on x86-64 Linux binaries.
Incident-response analysis of ZipExec, an Optiv PoC that base64-encodes a password-protected ZIP containing a binary, rebuilds it via a JScript loader using COM objects, and executes it in place using CMDKEY to inject the zip password, evading disk-based AV and EDR scanning and hash blocklists. The author dissects a generated loader (using calc.exe as the test payload) line by line and proposes detections such as alerting on ZIP filemod events sourced from wscript.exe and monitoring anomalous cmdkey.exe usage.
ZipExeccmdkey.exeWScript+2
Blue Team & Detection, Offensive Security, Malware & RE· 2021-10-25T00:00:00+00:00
A HackTheBox crypto challenge writeup ('xorxorxor') walking through how to break a weak custom encryption scheme where a flag is XOR-encrypted with a 4-byte repeating key generated via os.urandom(4). The author demonstrates a known-plaintext attack: since HTB flags always start with 'HTB{', the first 4 known plaintext bytes are XORed against the ciphertext to recover the full key, which is then used to decrypt the rest of the flag. It's a beginner-friendly explainer of XOR logic and how key reuse/short keys make repeating-key XOR trivially breakable with known-plaintext.
0xv1n.github.iotool