PID Mutation: Fooling Sysmon by Patching EPROCESS and ETHREAD
PID Mutation technique using BYOVD to spoof process attribution in Sysmon by patching EPROCESS and ETHREAD structures in the Windows kernel.
Windows
23 articles
Abusing Vulnerable Drivers to Terminate Privileged Processes
Detailed analysis of how to exploit vulnerabilities in Windows drivers to terminate privileged processes and evade EDR and AV solutions through the abuse of the TrueSight.sys driver.
Jan 7, 2025 Julio Ángel Ferrari Medina
What are Security Identifiers (SIDs)
Discover what Security Identifiers (SIDs) are in Windows, their structure, types, and how they are used in the security system to identify users, groups, and sessions.
Nov 19, 2024 Juan Antonio González Mena
Kali Linux on Windows Without Installation or Administrator Privileges with Qemu
Learn how to run Kali Linux on Windows without needing administrator privileges or installation using Qemu as a portable emulator.
Nov 12, 2024 Juan Antonio González Mena
Anatomy of the Portable Executable (PE) Format
Discover the internal structure of the Windows PE format: DOS headers, NT Headers, sections and data directories for malware development and analysis.
Oct 29, 2024 Juan Antonio González Mena
Kali Linux on Windows through WSL2
Learn how to install Kali Linux with a graphical interface on Windows using WSL2. Complete guide with three display modes and environment configuration.
Apr 24, 2024 Juan Antonio González Mena
Kali Linux on Docker
Complete guide to install and manage Kali Linux on Docker. Learn to configure the environment, tunnel traffic through Burp Suite, and manage containers.
Jun 5, 2023 Juan Antonio González Mena
How to Patch AmsiScanBuffer to Evade AMSI
Learn how to evade AMSI on Windows by patching the AmsiScanBuffer function, including the use of pinvoke to call native APIs and obfuscation techniques.
Mar 27, 2023 Miguel Ángel Cortés
How to Break Windows Defender (and explorer.exe by Accident)
Technical process that led to causing a crash in explorer.exe and disabling Windows Defender through the suspension of protected processes in Windows
Nov 21, 2022 Daniel Monzón