Labs

Medium

Bypass

Credential Access

Windows

The Diagnostic Loophole: Extract Secure Credentials from Windows Kernel Live Dumps

Elevated PowerShell diagnostic commands trigger kernel live dumps, writing LSASS process memory to disk. Attackers steal these cached credentials offline, […]

Learn more

Medium

Campaign, CyberCrime, Malware

Discovery, Execution

EDR, Sysmon, Windows

Deep Dive into Snow Flurry campaign: Edgecution Persistence and the "Headless Process Clean Up"

The Snow Flurry campaign leverages Edgecution persistence through scheduled tasks. It features an automated "Headless Process Clean Up" mechanism to […]

Learn more

Medium

CVE

Privilege Escalation

Windows

Certighost to Domain Takeover: AD CS chase referrals weaponized for Domain Controller impersonation.

Certighost (CVE-2026-54121) is a critical improper-authorization vulnerability in Microsoft Active Directory Certificate Services (AD CS) that allows any low-privileged authenticated […]

Learn more

Medium

Bypass

Execution, Privilege Escalation

EDR, Sysmon, Windows

LegacyHive: Windows ProfSvc enabling cross-user registry Hive Loading

LegacyHive is a Windows local privilege-escalation zero-day that abuses the User Profile Service’s registry hive-loading logic to redirect or expose […]

Learn more

Medium

Campaign, Malware

Defense Evasion

EDR, Sysmon, Windows

ClickFix to StealC: ResiLoader weaponizes pcdhost.sys BYOVD driver to achieve ring-0 code execution

ResiLoader drops the vulnerable pcdhost.sys driver in a BYOVD attack, using its kernel privileges to kill AV/EDR processes before hollowing […]

Learn more

Medium

Campaign

Defense Evasion

EDR, Sysmon, Windows

GentleKiller: Inside The Gentlemen RaaS EDR‑Killer Framework and Its BYOVD Driver Arsenal

The emerging Gentlemen RaaS equips its affiliates with the GentleKiller EDR‑killer framework and third‑party BYOVD tools to systematically disable more […]

Learn more

Medium

Campaign

Command and Control

EDR, Sysmon, Windows

ClickFix’s Second Door: SocGholish-Inspired Proxy-Based Intrusion Chains

ClickFix has evolved into a platform similar to SocGholish, integrating PySoxy to create durable and redundant access chains through automated […]

Learn more

Medium

Campaign

Credential Access

EDR, Sysmon, Windows

PowerShell P/Invoke of CredEnumerate for Credential Manager Extraction

In today’s threat landscape, SEO poisoning campaigns continue to evolve by leveraging technology trends and user trust in widely adopted […]

Learn more

Medium

Bypass, Campaign

Defense Evasion

EDR, Sysmon, Windows

When Forensics Becomes Offensive: Abuse of FTK Imager in the STAC3725 Tradecraft

STAC3725 campaign leveraging FTK Imager abuse to evade defenses, highlighting a stealthy technique repurposing forensic tools for low-noise persistence in […]

Learn more

Medium

Bypass

Privilege Escalation

Sysmon, Windows

RedSun: Turning Microsoft Defender into a Path to SYSTEM-Level Privilege Escalation

Developed by Nightmare-Eclipse, the same researcher of BlueHammer, RedSun is an unpatched local privilege escalation zero-day. It weaponizes Microsoft Defender’s […]

Learn more