iiinova — where your digital self keeps evolving

Jonny Johnson @jonny-johnson.bsky.social · 06/06/2025

Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been working on for the past couple months. This dives into DCOM Interfaces that enable remote ETW trace sessions without dropping an agent to disk. (Write-up and project link below)

jonny-johnson.medium.com

No Agent, No Problem: Discovering Remote EDR

As the reader, I’m sure you’re thinking — “oh great, another EDR internals or bypass post”. I can fully understand that sentiment, as…

131

Jonny Johnson @jonny-johnson.bsky.social · 28/01/2025

I am happy to announce JonMon2.0 has been published. 2.0 offers a lot of feature updates, as well as stability. More features still to come as time goes on. Enjoy and let me know if you have any issues or questions. Link: github.com/jsecurity101...

000

Jonny Johnson @jonny-johnson.bsky.social · 16/01/2025

New EtwInspector kinda going hard 👀

010

Reposted by Jonny Johnson

Evan McBroom @evanmcbroom.bsky.social · 08/01/2025

The perfect loader library was updated this week to support changes made on Windows 11 24H2. A big thank you to Jarrod Davis (@tinybiggames.com) for reporting the issue and helping work on a solution! A full writeup on the issues and fixes can be found here: github.com/EvanMcBroom/...

github.com

Windows 11 24H2 · Issue #1 · EvanMcBroom/perfect-loader

Hi, will this work in windows 24H2?

072

Jonny Johnson @jonny-johnson.bsky.social · 07/01/2025

Converted Matt Graeber's TraceLogging PS script into C# into the new EtwInspector. gist.github.com/mattifestati... Working quite well. New EtwInspector coming soon...

041

Jonny Johnson @jonny-johnson.bsky.social · 28/12/2024

My goal by the end of the year was to finish JonMon 2.0 and I am happy to say that I have done that....Now just to clean up the code, fix the wiki, and write a blog. Stay tuned :)

020

Jonny Johnson @jonny-johnson.bsky.social · 13/12/2024

Oh this is sick I didn’t know this. Thanks for sharing!

000

Jonny Johnson @jonny-johnson.bsky.social · 04/12/2024

Microsoft's Threat-Intelligence ETW provider now supports events to identify token impersonation attacks. I wrote a blog on these events and how Microsoft is surfacing them: jsecurity101.medium.com/behind-the-m...

jsecurity101.medium.com

Behind the Mask: Unpacking Impersonation Events

Introduction

092