klez

[RELEASE] Better late than never! Part 3 is out! Fantastic unwind information and where to find them. We went digging through .pdata, RTF Lookups, and a few ntdll internals that probably weren't meant to be touched. BYOUD dropping alongside. Enjoy 😉 klezvirus.github.io/posts/Byoud/

@_MrTiz Nice work, man! ;)

Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway. New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks. Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇 mrtiz.github.io/cet-callstack-…

[TALK] My latest Black Hat Europe talk is now publicly available. If you can look past the painfully obvious anxiety and a speaker who occasionally sounds like his brain has stopped cooperating, you might find something useful. Who knows? youtube.com/watch?v=tOVcSc…

@Octoberfest73 Blogged about this a while back if you'd like to take a look. Afaik it's been the default behaviour since a few years: klezvirus.github.io/posts/Lateral-…

Didn’t figure out what was causing this behavior, but landed on dropping the XLL in the %APPDATA%\microsoft\excel\XLSTART folder and then running excel to trigger it. It works and as bonus points it’s even a real adversary TTP cert.gov.ua/article/6285549

Had a blast talking with @Teach2Breach about offsec topics :D Take a look! Especially enjoyed sharing my experience and the amazing people I learned from.

New blog post is up looking at how LLMs are making local EDR rulesets, YARA rules, and behavioral detections trivial to extract. This post focuses on how simple the harness can be. Buckle up h4xx0rs, the next few months are gonna get interesting! specterops.io/blog/2026/06/2…

In september @MCTTP_Con - we will reveal our latest research about USB Co-Installer and Driver vulnerability exploitation for Privilege Escalation. 🔥🔥Super happy to work together with @KlezVirus on that research! 🫡

coping with c github.com/jonaslykkegaar…

✅Call APIs requiring 5+ args ✅Store return values ✅Chain multiple spoofed calls for sleep obfuscation ✅Zero user code required during execution ✅CET/HSP/Shadow stack compliant Big things coming to the UDRL and Sleepmask Development course...

Let me trace the timeline here because nobody's connecting it. Step 1: Scrape the entire internet. Every book, every article, every conversation, every piece of art, every forum post. Do it without asking. Do it without paying. Step 2: Train a model on all of it. Call it "artificial intelligence." Step 3: Go to BlackRock's Infrastructure Summit and announce: "We see a future where intelligence is a utility, like electricity or water, and people buy it from us on a meter." Step 3 is where you sell people's own knowledge back to them. On a meter. They took the collective output of human thought, compressed it into a model, and now they want to charge you by the token to access a version of what you and everyone you know already created. One Reddit user put it perfectly: "They stole all this data from us, the people, our life's work, creativity, art, by devouring the internet and blowing through all copyright laws. Now they want to sell it back to us in the form of a utility." Imagine if someone photocopied every book in the public library, burned the library down, and then opened a subscription service for the copies. That's the metered intelligence business model. And they're pitching it to infrastructure investors as though they invented water.

Everyone losing their minds over the Visual Studio Code payload hitting GitHub. The research was published on @MDSecLabs site in 2023! Red Teams have used this on assessments for ages!! Microsoft knows all of this and didn't bother to fix it!!! IT'S BEEN IN INITIAL-ACCESS FRAMEWORKS FOR YEARS!!!! mdsec.co.uk/2023/08/levera…

Oh shit now I actually have to deliver this....

If you came to SOCON, you may have seen the fireside chat on Ouroboros (if you weren't too busy counting my "urm"s 😝). The blog post is now live, detailing how we can use Dev-Tunnels for lateral movement, and allow pivoting from GitHub/Entra ID access. specterops.io/blog/2026/05/0…

I wrote a thing. if you are interested in obfuscation/de-obfuscation and compilers, but perhaps don't have a tangible experience with it, then i hope this story will be interesting to you and teach a few things along the way (-:

Introducing Combat Theater, a malware technique emulator built for blue teams, detection engineers and security researchers to perform testing and detection validation quickly and easily. Check out the introduction blog to learn more! combat.theater/blogs/introduc…

After more than a year in the making it is finally out and available here: xintra.org/courses/11-win… :) I will always do open source and publish papers but I've been working for a long time to create a course for people that want structured and in-depth content 1/

The InfoSec industry just lost (hopefully temporarily) one of the best news summary feeds. This site feeds into my threat intel feed and has been an awesome resource! Rest up Eric, and thanks for all you do!

@Idov31 That's a banger! Great job man! 🔥

A new post (with a new website design) is finally out: idov31.github.io/posts/hypervis…. After two years, I wanted to start posting again and really wanted to share something that contains some technical details about hypervisors, my opinions on utilizing hypervisors for defense and 1/2

@LorenzoMeacci Just read the blog post man, really great work! Keep it up! 🔥🔥🔥