@GerhSec

#OSWE | #OSEP | #OSCP | #EWPTX | #CRTE | #CARTE | #CARTP | #EMAPT | #AWSCommunityBuilder

gerhsec.com/
Joined May 2020
  • Tweets336
  • Following1
  • Followers90
Gerardo Eliasib retweeted
Jose Enrique Hernandez
@_josehelpsOct 24
Two more EDR killers just landed on LOLDrivers, both from Jehad Abudagga's (@j3h4ck) KillerLand research. Same BYOVD play: load a signed driver, hand it a PID, and let the kernel terminate the security tools for you. github.com/redteamfortress/K…

GitHub - redteamfortress/KillerLand: Collection of reversed vulnerable drivers weaponized into...

Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you. - redteamfortress/KillerLand

github.com
5
68
1
285
12,397
Gerardo Eliasib retweeted
clibm079@clibm079Oct 19
Windows API Hashing to Malware docs.redteamleaders.com/offe…

Windows API Hashing to Malware | Red Team Leaders

docs.redteamleaders.com
17
75
2,620
Gerardo Eliasib retweeted
Smukx.E
@5mukxOct 19
Building a Malware Development Lab, Part 1: Elastic EDR with a Self-Hosted Elastic Stack by bsdrip Blog:- blog.bsdrip.tech/maldev-lab/…
6
93
1
525
16,329
Gerardo Eliasib retweeted
/r/netsec@_r_netsecOct 18
PhantomBuffer: Effective EDR Evasion Through Stealth Injection zerosalarium.com/2026/10/Pha…

PhantomBuffer: Effective EDR Evasion Through Stealth Injection

PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)

zerosalarium.com
27
117
5,213
Gerardo Eliasib retweeted
Panos Gkatziroulis 🦄
@ipurpleOct 19
SyscallRevenant - a new method of performing clean indirect syscalls. The main component resolves System Service Numbers (SSNs) and syscall instruction addresses dynamically github.com/SilentisVox/Sysca…

GitHub - SilentisVox/SyscallRevenant: Clean Indirect Syscalls with Syscall Tampering.

Clean Indirect Syscalls with Syscall Tampering. Contribute to SilentisVox/SyscallRevenant development by creating an account on GitHub.

github.com
34
143
5,898
Gerardo Eliasib retweeted
clibm079@clibm079Oct 18
Masking Malicious Memory Artifacts Part I: Phantom DLL Hollowing Part II: Blending in with False Positives Part III: Bypassing Defensive Scanners forrest-orr.net/post/malicio…

Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing

IntroductionI've written this article with the intention of improving the skill of the reader as relating to the topic of memory stealth when designing malware. First by detailing a technique I term...

forrest-orr.net
28
92
2,984
Gerardo Eliasib retweeted
Nicolas Krassas
@DinosnOct 16
Setting Up REA with Claude Code — Teaching AI to Read Binaries with Ghidra (with Codex & OpenCode) e.ercanatay.com/rea-en

Setting Up REA with Claude Code — Teaching AI to Read Binaries with Ghidra (with Codex & OpenCode)

How we gave Claude Code, Codex and opencode a pair of Ghidra glasses at once to look inside apps with no source code, and every pothole we hit along the way.

e.ercanatay.com
12
125
2
573
22,922
Gerardo Eliasib retweeted
Panos Gkatziroulis 🦄
@ipurpleOct 16
TornadoC2 - Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64. github.com/kamalx06/TornadoC…

GitHub - kamalx06/TornadoC2: Pull-based C2 framework with ten native transports, concurrent...

Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-...

github.com
33
122
5,718
Gerardo Eliasib retweeted
Nicolas Krassas
@DinosnOct 16
Apex - a C2 framework with a native agentic AI operator interface. Connect any MCP-compatible LLM (Claude Code, Cursor, Codex) to the teamserver via a scoped token, and it can enumerate targets, author and upload modules, run them, read results, and adapt its next move based on this information. phantomsec.tools/blog/apex-c…

ApeX v0.4: Metis

ApeX C2 is here: an agentic, OPSEC-focused red-team C2 with a Zig agent, on-agent LuaJIT, native MCP operator, BOF and in-process CLR execution, and clean image-backed call stacks by architecture.

phantomsec.tools
2
8
51
4,838
Gerardo Eliasib retweeted
Panos Gkatziroulis 🦄
@ipurpleOct 16
DLL Sideloading for Initial Access and Bypassing Elastic EDR akchhat.gitbook.io/dev/initi…

DLL Sideloading for Initial Access and Bypassing Elastic EDR | Akchhat

akchhat.gitbook.io
1
35
1
122
9,759
Gerardo Eliasib retweeted
Nicolas Krassas
@DinosnOct 15
Bypassing AMSI & ETW: Building a Custom PowerShell Runspace in C# by7e.dev/blog/runspace

Bypassing AMSI & ETW: Building a Custom PowerShell Runspace in C#

Building a custom C# PowerShell runspace that bypasses AMSI and ETW while enforcing Full Language Mode. Breaking down each defensive layer and how operators can neutralize them using .NET reflection...

by7e.dev
2
10
90
5,910
Gerardo Eliasib retweeted
BallisKit
@BallisKitOct 8
Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse! EDR Eclipse is also compatible with ShellcodePack and MacroPack formats as well as all major C2s! blog.balliskit.com/tutorial-… #redteam

Tutorial: Disable EDRs with EDR Eclipse

EDR Eclipse is ShellcodePack post exploitation extension. It leverages non blacklisted vulnerable drivers to blind the EDR without…

blog.balliskit.com
26
127
8,279
I got you! Just found a way to steal local Windows user credentials 👀 Turns out, all it takes is a few simple hooks on put_Value and get_Value in credprovdatamodel.dll
8
24
1
303
14,207
Gerardo Eliasib retweeted
Panos Gkatziroulis 🦄
@ipurpleOct 9
Index of all known BOFs chryzsh.github.io/awesome-bo… #redteam
51
178
7,298
Gerardo Eliasib retweeted
PeterSR
@PeterSRWeb3Sep 30
This is a dataset of over 20000+ security findings. It includes everything you need: severity, description, POC. It was provided by @RightNowIn huggingface.co/datasets/Zaev…

Zaevlad/audit-findings-dataset · Datasets at Hugging Face

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

huggingface.co
3
42
346
17,099
Gerardo Eliasib retweeted
Nix0n
@UnTalNixon_exeSep 28
Olvídate de DCSync y las copias de sombra de NTDS. Si quieres extraer hashes de Active Directory sin hacer ruido, este es el camino. Timeroasting abusa del servicio de tiempo de Windows (NTP) para robar hashes de forma sigilosa. Y lo peor: pasa desapercibido en la mayoría de pipelines de detección. 🧵 ¿Cómo funciona y cómo detectarlo? 1️⃣ El protocolo olvidado: Abusa de la extensión NTP de Microsoft para recolectar hashes de cuentas de máquina (y en escenarios avanzados, cuentas manipuladas). 2️⃣ Cero alertas: El tráfico NTP es omnipresente en cualquier red corporativa, por lo que el ruido generado es prácticamente nulo comparado con otras técnicas. 3️⃣ Crackeo offline: Los hashes obtenidos se pueden tirar contra Hashcat (-m 31300) para romper contraseñas débiles. Los defensores necesitan empezar a monitorear anomalías en peticiones MS-SNTP ya mismo. Aprende a implementarlo paso a paso con PowerShell aquí 👇
11
131
6
572
37,621
Gerardo Eliasib retweeted
DirectoryRanger@DirectoryRangerSep 27
Dissecting Impacket. public reference of protocol-level and implementation-level indicators of compromise(IoCs) for detecting Impacket-driven activity #DFIR github.com/ThatTotallyRealMy…

GitHub - ThatTotallyRealMyth/Impacket-IoCs: This repo contains the results of an internal re-write...

This repo contains the results of an internal re-write of impacket I undertook at my current company. It contains some of the IoCs found within the library - ThatTotallyRealMyth/Impacket-IoCs

github.com
1
43
143
8,641
Gerardo Eliasib retweeted
Nicolas Krassas
@DinosnSep 25
New EDR evasion technique proves difficult to detect scworld.com/brief/new-edr-ev…

New EDR evasion technique proves difficult to detect

The technique, termed "process parameter poisoning," allows attackers to hide malicious code within the legitimate startup parameters of a Windows process.

scworld.com
130
4
617
28,984
Gerardo Eliasib retweeted
Hacking Articles
@hackinarticlesSep 23
BloodHound MCP: Automating Active Directory Analysis with AI 🔥 Telegram: t.me/hackinarticles ✴ Twitter: xitter.cf/hackinarticles Analyzing complex Active Directory environments can be time-consuming. BloodHound MCP combines AI with BloodHound data to accelerate attack path discovery and AD security assessments ⚠️ 📚 What You'll Learn in This Guide 🩸 Introduction to BloodHound MCP 🤖 AI-Powered Active Directory Analysis ⚙️ Setting Up BloodHound MCP 📊 Importing & Processing BloodHound Data 🔍 Identifying Attack Paths with AI 🎯 Privilege Escalation Path Discovery 👥 Analyzing Users, Groups & Permissions 🌐 Mapping Trust Relationships 🚀 Automating AD Security Assessments 📋 Natural Language Queries for BloodHound 🧠 Red Teaming & Defensive Use Cases 🛡️ Hardening Active Directory Environments 💡 BloodHound MCP enhances traditional BloodHound analysis by leveraging AI to interpret graph data, identify privilege escalation paths, answer natural language questions, and streamline Active Directory security assessments for both red and blue teams. 📖 Article: hackingarticles.in/bloodhoun… #BloodHound #MCP #ActiveDirectory #AI #RedTeam #Pentesting #CyberSecurity #EthicalHacking #ADSecurity #InfoSec
52
213
13,417
Gerardo Eliasib retweeted
Nicolas Krassas
@DinosnSep 24
Uncensored Qwen 3.8 27b helped write a LSASS Dumper which bypassed EDR while I made myself coffee projectblack.io/blog/bypassi…

Bypassing EDR with Local AI

How hard is it to bypass EDR in the modern times with AI? As it turns out, not very hard.

projectblack.io
6
66
1
817
42,624
Load more