iiinova — where your digital self keeps evolving

Reposted by jonhat

Olaf Hartong @olafhartong.nl · 06/08/2025

During my #BHUSA talk I've released many ETW research tools, of which the most notable is BamboozlEDR. This tool allows you to inject events into ETW, allowing you to generate fake alerts and blind EDRs. github.com/olafhartong/... Slides available here: github.com/olafhartong/...

github.com

GitHub - olafhartong/BamboozlEDR: A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.

A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes. - olafhartong/BamboozlEDR

02515 25

Reposted by jonhat

Fabian Bader @fabian.bader.cloud · 01/12/2024

🛡️Windows Firewall and WFP are only two ways to silence an #EDR agent. 📢In my latest blog post I discuss another network based technique to prevent data ingest and ways to detect it. And if you want even more, checkout part 2 released by @Cyb3rMonk Link in the post

cloudbrothers.info

EDR Silencers and Beyond: Exploring Methods to Block EDR Communication - Part 1

For red teams and adversary alike it’s important to stay hidden. As many companies nowadays have EDR agents deployed those agents are always in focus and tools like EDRSilencer or EDRSandblast use…

0209 20

Reposted by jonhat

RastaMouse @rastamouse.me · 30/11/2024

[BLOG] This post summarises how to tie Cobalt Strike's UDRL, SleepMask, and BeaconGate together for your syscall and call stack spoofing needs. rastamouse.me/udrl-sleepma...

rastamouse.me

UDRL, SleepMask, and BeaconGate

I've been looking into Cobalt Strike's UDRL, SleepMask, and BeaconGate features over the last couple of days. It took me some time to understand the relationship between these capabilities, so the aim...

03215 32