Tutorials
Windows InternalsTLS Callbacks: Thread Local Storage and Early Execution HooksTLS callbacks execute before your process entry point, inside the Windows loader, before any debugger prompt. Learn how IMAGE_TLS_DIRECTORY works, how to…Read →Exploit DevelopmentDefeating ASLR: Info Leak Primitives, Brute Force, and Partial OverwritesLearn how to defeat Windows ASLR three ways: recovering module bases via format string leaks, brute-forcing 32-bit low-entropy targets, and partial pointer…Read →Adversary EmulationEmulating T1053 – Scheduled Tasks: Creating, Hiding, and Detecting Persistence via Task SchedulerWalk through T1053.005 from three creation vectors to the Tarrask/HAFNIUM SD-deletion hide technique, then build layered Sigma rules and Sysmon coverage that…Read →Red TeamingETW Patching: Blinding Event Tracing for WindowsPatch EtwEventWrite and NtTraceEvent to blind ETW providers in-process, then learn exactly why PE-sieve, Sysmon EID 25, and ETW-Ti still catch you.…Read →Exploit DevelopmentInformation Leaks: Stack/Heap Disclosures, Format Strings, and Partial OverwritesModern exploits start with a leak. This tutorial walks the full chain - format string reads, heap metadata disclosures, and partial pointer…Read →Windows InternalsDLL Search Order and Hijacking PrimitivesLearn how the Windows loader resolves bare DLL names and how attackers exploit the search order for code execution. Covers search-order, phantom,…Read →Active Directory ExploitationKerberoasting From Zero: How TGS-REP Encryption Hands You Service Account HashesAny authenticated domain user can request service tickets encrypted with a service account's password-derived key - and crack them offline. This guide…Read →Adversary EmulationEmulating T1059 – Command and Scripting Interpreters: PowerShell, CMD, and WScript TechniquesReproduce real adversary tradecraft for T1059 - PowerShell encoded commands, CMD batch droppers, and WScript phishing chains - then wire up Sysmon,…Read →Red TeamingAMSI Internals and Bypass TechniquesLearn how AMSI works in-process, then defeat it three ways - AmsiScanBuffer memory patch, amsiInitFailed reflection, and DLL hijacking - while understanding…Read →Exploit DevelopmentASLR Internals: Randomization Scope, Entropy, and Weak ImplementationsUnderstand how Windows ASLR seeds randomization at boot, where entropy falls short on 32-bit targets, and how partial overwrites and format-string leaks…Read →Windows InternalsDLL Loading Internals: The Loader, LdrLoadDll, and Load OrderDive deep into Windows DLL loading internals - trace the LdrLoadDll call chain, walk PEB_LDR_DATA by hand, understand loader lock semantics, and…Read →Adversary EmulationWriting Sigma Rules for ATT&CK Techniques: Field Mapping, Conditions, and TuningLearn to write, tune, and convert production-quality Sigma rules for ATT&CK techniques - covering logsource taxonomy, field mapping pitfalls, condition logic, and…Read →