If you're into Active Directory, Entra ID or identity security, bookmark this. Researcher @_dirkjan has built one of the best FREE identity security research archives online. The rabbit hole covers: - Active Directory internals - Kerberos - NTLM relaying - Forest trusts + SID filtering - AD CS - mitm6 + krbrelayx - Zerologon - BloodHound - Entra ID internals - Primary Refresh Tokens - Windows Hello for Business - Conditional Access bypasses - OAuth + token abuse - Cloud Kerberos Trust - AD -> Entra lateral movement - Entra -> AD lateral movement - Temporary Access Pass abuse - Federated credentials - Managed Identities - Intune certificate abuse - ROADtools + ROADrecon + roadtx - Actor Tokens Some absolute classics: - Relaying Kerberos over DNS - NTLM relay to AD CS - Active Directory forest trust bypasses - Domain Admin from Entra via Cloud Kerberos Trust - Phishing Primary Refresh Tokens - Windows Hello key abuse - Conditional Access bypasses - Global Admin in every Entra tenant via Actor Tokens There are also years of FREE conference slides, demos and presentations. Blog: dirkjanm.io/ Talks + slides: dirkjanm.io/talks/ Huge credit to @_dirkjan / Dirk-jan Mollema for publishing so much deep identity research openly. #ActiveDirectory #EntraID #RedTeam

Proper old-school hacker energy. If you're into Windows internals, exploit development, malware memory or reverse engineering, Forrest Orr's (@_ForrestOrr) work is absolutely worth bookmarking. The FREE archive covers: - Windows memory corruption - Stack overflows + ROP - DEP, ASLR + CFG - Shellcode development - Windows internals - Malware memory artifacts - Phantom DLL Hollowing - Process injection + hollowing - Memory scanner evasion - Moneta memory analysis - PE internals - Browser exploitation - Chrome UAF exploitation - Firefox / IE exploit chains - Sandbox escapes - Defensive memory analysis And unlike a lot of modern security content, there are actual tools, PoCs, shellcode and exploit-development experiments to go with the research. Blog: forrest-orr.net/ ExploitDev repo: github.com/forrest-orr/Explo… Some of this is older material, but that's part of what makes it good. Proper fundamentals and low-level research that still teaches you how the machinery actually works. Huge credit to Forrest Orr (@_ForrestOrr) for keeping it publicly available. #ExploitDevelopment #WindowsInternals #ReverseEngineering

If you're learning malware analysis or reverse engineering, bookmark this. RPISEC released the full materials from its Malware Analysis university course for FREE. 12 lectures + 10 hands-on labs + 4 projects covering: • Static + dynamic malware analysis • x86 + IDA • Windows internals + WinAPI • Malware behavior + persistence • Anti-disassembly • Anti-VM + anti-debugging + anti-AV • Packing + unpacking • Windows kernel + drivers • Rootkit techniques • Hooking + DKOM • Anti-forensics + covert channels • Runtime process manipulation • APT sample analysis It was designed for students starting with zero reverse engineering experience and built heavily around Practical Malware Analysis. github.com/RPISEC/Malware Huge credit to RPISEC and original authors Branden Clark, Austin Ralls and Aaron Sedlacek for making the course materials publicly available. #MalwareAnalysis #ReverseEngineering #WindowsInternals

This @BeyondTrust incident is worth reading, especially if you work in detection engineering or threat hunting. @Mandiant says ARMORY CASTLE exploited CVE-2026-102764 in BeyondTrust Remote Support as a zero-day. Post-exploitation got ugly: - SAWFLY PHP webshell - Service account -> root - Attempted credential vault extraction - Persistent passwordless root access - Systematic log deletion - BARECLAW WebSocket/SOCKS5 tunneler - Admin session abuse - Pivoting into downstream systems But the part defenders should read twice: BeyondTrust says its sensors fired high-severity alerts in real time when the actor escalated privileges. A third-party automated triage system closed them as false positives. Their separate threat-intelligence-driven hunting pipeline later surfaced the activity. That is such an important detection engineering lesson. Having telemetry and alerts is only part of the job. You still need strong detection engineering, active threat hunting, validation, R&D and people who understand what the adversary is actually doing. The sensors saw it. The surrounding detection process failed to escalate it. Excellent research and transparency from the @Mandiant and @BeyondTrust teams. Mandiant technical analysis: cloud.google.com/blog/topics… BeyondTrust incident timeline + BT26-05: beyondtrust.com/blog/entry/b… Patch BT26-05 and read both write-ups. #ThreatIntel #DetectionEngineering #Infosec

If you're into malware analysis or reverse engineering, bookmark this. @hasherezade has built an incredible collection of FREE research, tools, articles and talks covering: - Malware reverse engineering - PE internals + analysis - PE-bear - PE-sieve + HollowsHunter - Process injection + hollowing - Malware unpacking - Ransomware analysis - Custom malware formats - Rhadamanthys - Petya / NotPetya - Shellcode + in-memory implants - V8 JavaScript bytecode deobfuscation Her research archive goes back more than a decade, with everything from classic Windows malware analysis to Black Hat USA 2026 research. Projects: hasherezade.github.io/ Articles: hasherezade.github.io/articl… Talks + slides: speakerdeck.com/hshrzd Huge credit to @hasherezade for publishing so much of this work and tooling openly. Absolute rabbit hole for malware analysts, reverse engineers and threat researchers. #MalwareAnalysis #ReverseEngineering #Infosec

This is why the anti-cheat arms race is getting so interesting. Riot is pushing Vanguard further into hardware-backed trust, attestation, VBS/HVCI, IOMMU and deeper platform security. At the same time, AI-assisted reverse engineering is making it much faster to tear apart the software sitting on top of those protections. @k0mkc is showing heavily devirtualized VGK internals and says he can now devirtualize the entire thing. On the EAC side, @in19h has published tooling that recovers large parts of a heavily virtualized Easy Anti-Cheat Linux sample into readable code and IDA artifacts: github.com/19h/eac-linux-dev… There is an important parallel here with EDR. An EDR is only as effective as the detection engineering, threat hunting and R&D behind it. Anti-cheat works the same way. You need researchers constantly following new techniques, detection engineers turning that research into useful telemetry and detections, and people actively hunting for behaviour that existing rules may miss. That means continuously keeping up with: - new cheat architectures - kernel abuse - BYOVD - hypervisors - DMA - firmware tricks - input manipulation - virtualization + obfuscation - new bypass techniques The game was already there. AI is speeding it up and lowering the barrier to reversing, classification, devirtualization and research. That forces both sides to iterate faster. A lot of respect to the Vanguard team as well. They have clearly been keeping up with some of the most cutting-edge work in Windows security, hardware-backed trust, kernel security and anti-cheat research, and their recent Vanguard On-Demand changes show how quickly the defensive side is evolving too. This is becoming a much faster research cycle on both sides. Where does the arms race go next? Huge credit to @k0mkc and @in19h for the research. #AntiCheat #ReverseEngineering #WindowsInternals