PID Mutation: Fooling Sysmon by Patching EPROCESS and ETHREAD
PID Mutation technique using BYOVD to spoof process attribution in Sysmon by patching EPROCESS and ETHREAD structures in the Windows kernel.
JanFebMarAprMayJunJulAugSepOctNovDec
1 contribution in the year 2026
About me
Hey 👋 I’m S12, also known as David.
I focus on Windows offensive security research: kernel internals, EDR evasion, C2 development, and process injection techniques. I have a background in full stack web development and formal studies in web application development and computer systems and networks, but my real path has been self taught on the offensive side.
I currently run 0x12 Dark Development, an offensive security training platform, also I publish regularly in my Medium page Medium
Currently open to cybersecurity roles, offensive security is my focus, but open to anything in the field
You can follow my work on GitHub and Twitter.
Articles by S12
Clear filter This author has not published articles yet.