Chief Security Officer (CSO) || Security Researcher
Joined September 2024
- Tweets349
- Following125
- Followers5.6K
- Likes950
Joe, IT guy, when scanning the entire internal network to find all running PHP web servers (following the boss’s order to patch the php2shell ):
A server named TEST-WEB-SERVER : no one knows which intern set it up or when
A server named PHP-CRITICAL-TEST: it’s been there since the previous IT guy quit 3 years ago
A server named INTERNAL-BACKUP : He know about it. It doesn’t show up in the scan results because last night he listened to the “security experts” and upgraded PHP from the ancient version to 8 and it refuses to start now
A typical victim of php2shell
Keep your certificates safe, or one day they'll ruin you.
-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----
#eMudhra
ALT emudhra ltd stock crash
*#Cybersecurity #Interview tip*
A bonus question I often ask candidates during interviews:
If you're in a room with a laptop that has a #Windows locked screen, and you're the only one there, can you unlock it and get to the Desktop? If so, how would you do it?
I've received quite a few very creative answers 😁
ALT cybersecurity interview tip: question to unlock windows
Using SendMessage with WM_SETTEXT, we can perform stealth injection and bypass EDR, even with high-end Endpoint Detection and Response systems 🛡️
Github: TwoSevenOneT/PhantomBuffer
#CyberSecurityAwareness #Pentesting #redteam
ALT PhantomBuffer edr evasion run success with high end EDR monitor
ALT FindTargetWindows ultility in PhantomBuffer bypass edr tool kit
PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)
#redteam #Hacking #Pentesting
Detailed article:
zerosalarium.com/2026/10/Pha…
The Rusty guys at Microsoft are messing around with WinDbg 🙃
After stopping the debugging process, the DbgEng engine fails to release all objects, preventing a second dump file from being opened.
A golden rule: Always release what you allocate.
While building an automated analysis tool, I spent the whole day scratching my head over this bug in the latest WinDbg version 🤯
ALT Windbg leak - not release all handles after stop debugging
🥷 Now we can inject a payload into a remote process without using VirtualAllocEx and WriteProcessMemory.
No need to suspend the target process
New technique to evade EDRs:
Github: TwoSevenOneT/InjectSetConsole
#redteam #pentest #antimalware
InjectSetConsole performs process code injection by leveraging a Windows named pipe.
Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.
#securityblog #cybersecurity
zerosalarium.com/2026/09/edr…
PE‑OopsSec is a security utility designed to identify and flag common OPSEC mistakes hidden inside PE files
Like this: E:\Movies\Action\Not_Porn\I_Swear_Its_Not\Why_Would_I_Lie\You_Have_Trust_Issues\Told_You_So\Empty_Folder\NASA_hot_kitten.jpg.pdb
Github: TwoSevenOneT/PE-OopsSec
#redteam #antimalware #pentest
ALT PE-OopsSEC PECheck run demo
ALT PE-OopsSEC PEHash run demo
PE‑OopsSec automating the detection of sensitive leaks: hardcoded paths, debug artifacts, or metadata that could expose operational details.
Think of it as your safeguard against accidental disclosures
#securityblog #cybersecurity
zerosalarium.com/2026/07/pe-…
Been coding a lot with AI, so now I’m creating a toolkit (also AI‑assisted 😄) to check for OPSEC mistakes in PE files before they’re used in the real world.
Both the article and the toolkit will be released soon 🤗
ALT PE-OopsSec IAT check
ALT PE-OopsSec Imphash check
New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker
ALT EDRChoker run throttling EDR process list
ALT Elastic EDR blocked by EDRChoker
ALT EDRChoker run remove throttling EDR process
EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.
#itsecurity #securityblog #altimalware
zerosalarium.com/2026/06/edr…
Some powerful built-in Windows 11 programs are allowed to write files to Defender’s working directory:
\System32\msiexec.exe
\Register-CimProvider.exe
\svchost.exe
\lsass.exe
Tools and methods to find these whitelisted programs for other #antimalware
Github: /TwoSevenOneT/DefenderWrite
Challenge: Drop #mimikatz onto a drive with the latest Windows 11.
1. Found a way to write a file into Windows Defender’s working directory: Success ✅
2. Dropped "mimikatz.exe" into that folder: Failed 🛑
Conclusion: Windows Defender does not exclude its own executable folder
While I was trying to evade cloud-based EDRs, I accidentally found a way to temporarily block a client's machine network with a POC running as a Normal user.
Not using the Windows Filtering Platform (WFP) which requires Admin priv
I haven't thought of exploitation scenarios for this tool yet, it might be a dead-end #antimalware research direction 🤔
#redteam
ALT block a client's machine network with a POC running as a Normal user
