~/otter

Exploiting race conditions in Seclogon to bypass PPL protections dump LSASS.

How CPU virtualization extensions can be weaponized to build implants invisible to the host OS.

A deep dive into ETW providers and how EDRs consume telemetry under the hood.

Abusing the W32Time service to load custom DLLs and persist through reboots.

Reversing how LSASS caches and decrypts DPAPI master keys in memory.

Extracting screenshots and activity data from Microsoft's unencrypted Recall database.