MetallicHack @MetallicHack

🇨🇵 Cybersecurity engineer enjoying Windows & AD security, DFIR and detection engineering @TheDFIRReport analyst Joined November 2020

Tweets

934
Followers

839
Following

389
Likes

4K

Jonas L @jonasLyk

6 days ago

x.com/i/article/2062…

17 164 481 78K 269

View Details

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

582 4K 12K 7.5M 4K

View Details

Jonny Johnson @JonnyJohnson_

a month ago

Have you ever wanted to query ETW providers, but didn't want to open a VM? What about checking the difference of ETW providers/events across OS builds? Today I am releasing EtwWatcher - a tool that brings EtwInspector to GitHub pages so that you can query ETW providers, as well as compare them across builds. This is something I wish I had for YEARS but have always opt'd to pull manually through a VM. I plan on being very active in uploading new snapshots as new OS builds come out. Check it out! Blog: jonny-johnson.medium.com/etwwatcher-f65… Repo: github.com/jonny-jhnson/E… Live site: jonny-jhnson.github.io/EtwWatcher/

4 43 132 22K 87

View Details

Nasreddine Bencherchali @nas_bench

a month ago

Have you ever wondered why svchost can spawn from Windows Defender MsMpEng.exe withouth any flags, even though a legit svchost should always have flags? Welp that's because its not a real svchost :D Read - Why Does MsMpEng Spawn svchost.exe Without Flags? - research.nasbench.dev/research/other… TL;DR - MpEngine.dll (AKA Windows Defender Engine) has a function called CreateCraProcessHelper that is used as part of the AntiRootkit scanner. In it, it spawns a suspended process with just the CLI "svchost". This is used by the engine and KSL driver to pass specific bytes from the \Device\PhysicalMemory between "Kernel" and "User mode" :D

2 41 184 13K 121

View Details

quarkslab @quarkslab

a month ago

Do you know how Entra ID applications work? What about the security mess they can bring and what they can quietly break? New blog post on Entra ID application permissions, the audit nightmare they create, and QAZPT, our OSS tool built to make sense of it: blog.quarkslab.com/auditing-appli…

0 17 84 20K 95

View Details

Haidar @haider_kabibo

2 months ago

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato securelist.com/phantomrpc-rpc…

16 165 790 51K 498

View Details

Origin @originhq

2 months ago

Process argument spoofing has focused on modifying the PEB before a suspended process resumes. @jdu2600 traces what happens after and finds the initialization timeline has its own injection windows - ones that fire after the allow decision has already been made. originhq.com/blog/post-star…

0 22 42 8K 23

View Details

Sylvain Peyrefitte @citronneur

3 months ago

klist2kirbi is a tool that convert klist.exe output into a valid kirbi ticket ! Available in kerlab github.com/airbus-cert/ke… 🔵 Microsoft-Windows-Security-Kerberos #ETW provider exposed the event ID 202 that will monitor attempts to export sessions keys🔵

0 39 108 7K 73

View Details

Natalie Silvanovich @natashenka

4 months ago

Part 2 of @tiraniddo’s Windows Administrator Protection journey is here! projectzero.google/2026/02/window…

0 47 124 22K 58

View Details

Natalie Silvanovich @natashenka

5 months ago

No security feature is perfect. @tiraniddo reviewed Windows’ new Administrator Protection and found several bypasses. projectzero.google/2026/26/window…

3 69 196 28K 93

View Details

Connor McGarr @33y0re

5 months ago

[New @originhq blog+POC] No PPL? No problem! SecurityTrace, an undocumented ETW feature, restricts some AutoLogger traces to PPL only — yet we found this current design still allows non-PPL processes to consume from Threat-Intelligence as admin only! originhq.com/blog/securityt…

4 82 174 22K 93

View Details

SpecterOps @SpecterOps

5 months ago

WSL2 is a powerful attacker hideout because it runs as a separate Hyper-V VM, and defenders rarely monitor it. Daniel Mayer explains how attackers pivot into WSL2 and what it took to build tooling that works across WSL2 versions. Read more ⤵️ ghst.ly/45fPUma

9 172 725 104K 567

View Details

R136a1 @TheEnergyStory

5 months ago

This blog post provides an in-depth analysis of #Turla's #Kazuar v3 loader and how it tries to slip past modern defenses: • Sideloading via MFC satellite DLLs • Control flow redirection trick (+ POC) • Patchless ETW and AMSI bypasses (+ POC) • Extensive COM usage for registry, file and folder operations (+ partial POC) • Strings encryption (+ IDAPython decryption script) • Including IOCs and Yara rules r136a1.dev/2026/01/14/com…

4 86 245 24K 187

View Details

dis0rder @dis0rder_0x00

5 months ago

As promised here is my approach to using the Windows Debugging API to inject shellcode (w/o direct process read/write) Had a lot of fun playing with this! (Currently tested agains MDE & Elastic) github.com/dis0rder0x00/D…

7 114 419 39K 255

View Details

Outflank @OutflankNL

5 months ago

Let's play peekaboo with PatchGuard! Read our blog post about hiding processes on modern Windows systems with HVCI enabled: outflank.nl/blog/2026/01/0…

6 126 317 26K 167

View Details

Andrea Allievi @aall86

5 months ago

andrea-allievi.com/blog/new-year-… Anti-cheat evolution in Windows... New Year post while I am in vacation is ready!!! 🎉 Happy 2026!

1 38 86 12K 47

View Details

@

5 months ago

Securelist Blog | The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor securelist.com/honeymyte-kern…

0 8 27 3K 11

View Details

Haidar @haider_kabibo

6 months ago

Remember the old Control Panel applets that were used for initial access. I found that these DLLs can be loaded into memory remotely through an interesting DCOM object, allowing to achieve new command execution technique during lateral movement. Details: sud0ru.ghost.io/yet-another-dc…

2 35 116 10K 86

View Details

Jeffrey Snover @jsnover

6 months ago

Ever wonder why we call them "Cmdlets" in PowerShell instead of just "Commands"? jsnover.com/blog/2025/12/1… #PowerShell

4 24 93 15K 44

View Details

Andrew Oliveau @AndrewOliveau

6 months ago

🔥Introducing a new Red Team tool - SessionHop: github.com/3lp4tr0n/Sessi… SessionHop utilizes the IHxHelpPaneServer COM object to hijack specified user sessions. This session hijacking technique is an alternative to remote process injection or dumping LSASS. Kudos to @tiraniddo for first discovering this years ago. Blue Team tip: Look for unusual child processes spawning from HelpPane.exe