Red/Purple Teamer | Blogger | Mod @ https://xitter.twitterapi.xyz/t.co/f4RyUGl0zb | https://xitter.twitterapi.xyz/t.co/nLrzzAcQw9
Internet
Joined January 2012
- Tweets15.9K
- Following823
- Followers28.2K
- Likes4.3K
Modular persistence toolkit. C# assembly, unified BOF, Mythic command, and Cobalt Strike aggressor. github.com/Whispergate/Tendrβ¦
Another article on ADWS has been dropped recently that uses mostly Rust-based tools to conduct the enumeration and the collection (RustHound + adshell).
Tools change, but the behaviors don't. If you are looking for the detection details, I wrote an article a year ago.
π΄ blog.safetech.red/adws/
π£ ipurple.team/2025/08/12/actiβ¦
Copperhound - Open-source Active Directory, ADCS and Entra ID / Azure attack-path analysis, built in Rust for very large environments. CopperHound ingests:
β
SharpHound
β
bloodhound-python
β
ldapdomaindump and
β
AzureHound output
β
raw LDIF dumps and Sysinternals
β
AD Explorer snapshots into a memory-mapped graph
github.com/BenTheCyberOne/Coβ¦
A standalone, C2-agnostic Beacon Object File (BOF) for executing commands over WinRM using NTLMv2 pass-the-hash authentication.
The BOF handles NTLM authentication, session signing and sealing, and encrypted WSMan communication directly in memory. No Mimikatz, SSPI, credential injection, or external executable is required.
github.com/AlexLinov/WinRM-Pβ¦
ScriptBlock Smuggling to evade AMSI ipurple.team/2026/11/11/scriβ¦
What happened to the "try harder" mindset that OffSec championed within the information security community for years?
Yes, the course is about AI, but using AI to pass a certification on AI still feels weird.
3
30
3,065
ποΈ I wrote an article today to approach ScriptBlock Smuggling that is used for AMSI evasion. The article is balanced between emulation and detection guidance for cyber defense teams.
π«ππππππππ πΊπππππππππ
β
οΈ Module & ScriptBlock Logging | 4103 & 4104
β
οΈ Image Load | 7 (Sysmon)
β
οΈ File Creation | 11 (Sysmon)
β
οΈ Portable Executable | 29 (Sysmon)
βοΈ ipurple.team/2026/11/11/scriβ¦
Beyond PEB Walking: Alternative Ways to Find DLL Base Addresses and Resolve Functions at Runtime blog.jaytiwari.me/posts/Beyoβ¦
This POC replicates the custom mixed-mode technique utilized by Turlaβs CerealLoader gist.github.com/TheEnergyStoβ¦
Cracking downgraded NTLMv1 SSP hashes with rainbow tables hunio.org/security/ntlmv1-ssβ¦
Doing some late-night testing with ScriptBlock Smuggling. In a nutshell, its key use cases include:
β
Potentially evade AMSI Inspection
β
Conceal malicious PowerShell activity
β Low Sophistication
β Noisy - Multiple Telemetry Events
14
1,098
Two Clicks to a Beacon: Abusing ClickOnce Deployments for Initial Access akchhat.gitbook.io/dev/initiβ¦
I really miss the days when I could find interesting information security tools, research, and discussions on Twitter/X.
There has been a lot of noise over the past few years.
1
10
1,232
nukerat - A post-exploitation framework for advanced Red Team operations github.com/nukeratframework/β¦
Lure - Plants fake credentials
If a threat actor attempts to use them, an alert is generated that says which file was found and where you planted it. github.com/SilentMesh-Systemβ¦
Silverseal - an open-source Linux bootkit and rootkit framework written in Rust, using UEFI and early kernel boot hooks to load a stealthy kernel rootkit. github.com/Idov31/Silverseal
homer - Evasive fork of Donut to generate position-independent shellcode that loads PE Windows payloads from memory github.com/twili8/homer
Crapy Lnk Files Alter to dump your NTLM hashes to your responder listener upon user interaction github.com/Ossipher/Quick-Shβ¦
An enterprise-grade, host-based behavioral detection engine built in Python 3.12 for identifying Living-off-the-Land Binaries, Scripts, and Libraries (LOLBins) on Microsoft Windows endpoints. github.com/nimesh895/Behavioβ¦
Crucible - a Mythic C2 agent purpose-built for purple team adversary simulation.
It transforms Atomic Red Team YAML test definitions into a self-contained .NET 9 executable (Windows or Linux) that checks in as a Mythic callback, waits for operator tasking, then executes the campaign on command, reporting per-technique results back to the Mythic UI in real time.
github.com/Whispergate/Cruciβ¦
