winternl

tl;dr: Source: https://github.com/jackullrich/AADBrokerDecrypt The Azure AD Broker (AAD Broker) is a component of Entra ID that orchestrates Azure AD sign-in, device-bound primary refresh token (PRT) handling, and application token issuance exposed by Win…

GLP-1s need not apply.

If your career as a programmer has led you here, fear not, there is still time to turn back.

A client used donut to generate a reflective loader for a 64-bit PE file.

(And other difficult conversations to have with your kids) If you’ve spent some time with MSVC you may have noticed your binary contains an IMAGE_DEBUG_DIRECTORY entry — even when building in release mode.

Aternity is software developed by Riverbed used to monitor the performance of applications and devices from the end user perspective.

Offensive tooling built upon the .NET framework and its runtime environment, the Common Language Runtime (CLR), is an important part of the red teaming ecosystem. .NET tools offer rapid development times, a low barrier to entry, and are highly extensible…

By now direct system calls are ubiquitous in offensive tooling.

Antimalware emulators have the Sisyphean task of implementing a complete and accurate clone of the Windows environment.

Dynamic malware analysis is the preferred way to determine the legitimacy of an application for many AVs/EDRs/MDSs.