Grateful for the recent conversations we've had with @techspence and @alehurtadoxo
youtu.be/INz5r8a1-6w?si=EnvL…
xitter.cf/alehurtadoxo/status/21…
Definitely give them a view and a subscribe. Lots more inbound friends
I had two of the founding fathers of detection engineering on Detection Dispatch to talk about what they've been farming with the community. 🌱
LOLDrivers. LOLRMM. LOLSkills.
Catalogs that track legitimate tools and components that attackers abuse, giving us a shared place to build knowledge, hunt, and detection engineer the ways of prevention.....but the conversation went somewhere I didn't expect.
I've spent so much of my career thinking about detection that this episode genuinely had me rewiring my brain around app control/prevention....Prevention isn't a replacement for detection. We need both, and I think we need to talk a lot more about how they work together. That's the episode, you don't want to miss.
Thank you @M_haggis & @_josehelps for the laughs 🦉 🦉 🦉 🦉
Full episode dropping this weekend, subscribe to my Youtube channel to be notified 🔔
All you need to know about JA3 & JA4 Fingerprints (and how to collect them) medium.com/@ggabrielhd/all-y…
Panos Gkatziroulis 🦄 retweeted
Telling folks cyber is that serious and this week we saw why. 🥲
Sharing the panel with @OpenAI ✨
FYI, the invite expires in 3H ⤵️
There are updates in the iPurple Discord server today, with more planned later today.
Whether you're on the red, purple, or blue team side, feel free to join us.
⏰ Invite Expires in 24H
➡️ discord.gg/XmJCvkbT
I wrote an article about the technique that was disclosed some years ago by @mrd0x - Custom Extensions, including detection opportunities.
TL;DR: Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious file as a legitimate file or evade Windows SmartScreen.
🖊️ ipurple.team/2026/10/22/cust…
While everybody is prompting for PHP, recently I ended up having to dump the LSA in a custom way.
I have written a short article on the entire LSA decryption stack, with the C implémentation. 💫
Cross posted here blog.advens-c.tf/articles/ls… and here hideandsec.sh/books/windows-…
From Boot Key to Plaintext: How Windows LSA Secrets Are Deciphered from the Registry hideandsec.sh/books/windows-…
There are updates in the iPurple Discord server today, with more planned later today.
Whether you're on the red, purple, or blue team side, feel free to join us.
⏰ Invite Expires in 24H
➡️ discord.gg/XmJCvkbT
Hiding a DLL from the PEB Loader List (And Why Process Explorer Still Sees It) trainsec.net/library/windows…
Panos Gkatziroulis 🦄 retweeted
Replying to @ipurple @_JohnHammond
100% agree. Skilled humans with domain specific knowledge still need to ask the right questions, and evaluate answers - AI is an agent not an actor and cant generate its own intent or motivation. AI isnt replacing anyone with domain specific knowledge. Learning is still valuable.
A project that uses Confluence as a C2 🧐
github.com/dagowda/Confluenc…
Writing a Beacon Object File (BOF) from Scratch in C by7e.dev/blog/bof-from-scrat…
I spent some time yesterday testing the PhantomBuffer technique released by @TwoSevenOneT. A few observations:
✅ Requires elevated privileges
✅ ~32 KB implant size limitation
✅ Stealthy from a common API monitoring perspective
⚠️ Noisy from a debugger/telemetry perspective due to process attachment
Interesting technique nonetheless.
Full video below - Calc version:
Technique Article --> zerosalarium.com/2026/10/Pha…
Some variations of the same technique:
2018: vallejo.cc/2018/04/poc-copy-…
2019: hexacorn.com/blog/2019/06/28…
Panos Gkatziroulis 🦄 retweeted
New post: Writing a Beacon Object File from scratch in C.
COFF internals, dynamic import resolution, and building a privilege enumeration BOF - no frameworks, no wrappers.
Plus why execute-assembly lights up every EDR while BOFs barely register.
by7e.dev/blog/bof-from-scrat…
Panos Gkatziroulis 🦄 retweeted
Try default-deny app control free with MagicSword.io: magicsword.io
Skarvel, a tool developed by @twelvesec takes a single indicator of compromise, finds every public repository carrying it, digs through all their branches and pull requests, mines fresh IoCs from confirmed payloads, and keeps hunting github.com/twelvesec/Skarvel












