Panos Gkatziroulis 🦄

Registry Snapshots for Post Exploitation Enumeration Welcome to this Medium post! I'll introduce rsnap, a tool that snapshots a Windows registry hive from a target machine for offline exploration in a web dashboard format @s12deff/registry-snapshots-for-post-exploitation-enumeration-fbf5798091da" target="_blank" rel="nofollow noopener">medium.com/@s12deff/regis…

✍️ One of the articles that I wrote last month was a detection approach and emulation playbook of abusing QoS Policies to throttle EDR traffic. Not the first time that a legitimate functionality is used to block EDR traffic (AppLocker, Firewall rules) 🔗 ipurple.team/2026/06/17/qos…

@_JohnHammond Claude?

oh sorry my bad

@HackingDave Already registered last week. I’m not in a position to buy it right now, but who knows in the future + I never miss one of your talks or webinars.

Hey folks! Def need to register for this if interested in AI, defense, what we've been working on the past year and a half and how we applied AI to create some amazing synergies for the SOC and respond faster than ever thought possible before. I'll be driving, showing the tech, but how it has a huge impact in the future of cybersecurity! Register now!! #BinaryDefense

BingusLdr - a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique github.com/Sizeable-Bingu…

BingusLdr - CET Compatible Stack Spoofing bigbingus.com/posts/bingusld…

Invite expires in 2H! If you want to join, the time is now! 😀

More SIGMA & Sysmon Rules have been added to the Discord. If you work in the same domain and want to receive early access to Playbooks & Detection Rules, join our Discord! ⏰ Duration: 24H 📩 Invite: discord.gg/7yjuG7xQ

@OliviaGalluccii @BlackHatEvents Looking forward to the recording. Congratulations!

Long overdue, but... I'm *so so so* excited to announce that I'll be speaking at @BlackHatEvents (Day 1) on my detection engineering research! I am incredibly grateful for this opportunity. It's hard to put into words how much the faith, support, and encouragement from the security community over the past two years has meant to me. Thank you to everyone who has believed in my research and helped make this possible.

@PaulaCqure @BlackHatEvents Saw your latest webinar! Keep up the good work!

Cool project for Red Teaming / Pentesting! lolcreds.haxx.it

Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway. New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks. Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇 mrtiz.github.io/cet-callstack-…

Great work by @_MrTiz and a very long read! CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining mrtiz.github.io/cet-callstack-…

We are also growing steadily here ⤵️ x.com/i/communities/…

[TALK] My latest Black Hat Europe talk is now publicly available. If you can look past the painfully obvious anxiety and a speaker who occasionally sounds like his brain has stopped cooperating, you might find something useful. Who knows? youtube.com/watch?v=tOVcSc…

@KlezVirus All your posts/talks are top. It’s been sitting in my browser tabs since it was released. I will definitely watch it once I get some proper time!

It looks like @olafhartong is busy with Sysmon this evening! 😀

@AstharotRTO There are, every rule could be fine-tuned further ofcourse. The point is for SOC teams to get the detection logic and then decide how to proceed, tune/improve, or ignore.

@ipurple There are writable directories in system32