Write-ups, field notes and walkthroughs from the team.
A weekend Process Monitor boot log turned into a full DLL side-loading study: finding a hijackable load in Google's updater service, building and stabilizing a PoC with a DLL proxy, turning it into SYSTEM persistence, and the detection and forensic opportunities it leaves behind.
Read Post
Reproducing Red Canary's mavinject.exe injection into LSASS on Windows 11: why PPL makes it fail, why Sysmon Event ID 7 only shows the successful injection, and how Event 4689 exit codes tell success from failure when the tool stays silent.
Read Post
A weekend PoC that starts PowerShell suspended with a harmless command line, rewrites the command line in its PEB and resumes it: Security 4688 and Procmon log Write-Host while PowerShell downloads an executable. How it works, the length-field trick, and how to catch it with context.
Read Post
A ShimCache entry does not mean the program ran. Walking through AppCompatCacheParser's "Executed" column, a Prefetch cross-check, the last-four-bytes assumption and where it breaks down — and why you must understand how an artifact and its tools really work before you conclude.
Read PostSubscribe for practical cybersecurity notes and training updates.
