TrainSec Academy - Where pros train pros (@TrainSec) header
TrainSec Academy - Where pros train pros (@TrainSec) profile picture

Learn Windows Internals, Malware Analysis, Malware Development, Hardware Hacking & Code Development from @UrielKosayev, @zodiacon & @The_H1tchH1ker

Joined August 2023
Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)Photo by TrainSec Academy - Where pros train pros (@TrainSec)
New live masterclass: Malware Analysis to Detection Engineering with Uriel Kosayev. One Windows malware investigation, from triage to an Elastic detection that survives bypass testing. Hands-on, 4 hours. Nov 12, 15:00 UTC.
Your detection fired in the lab. Now the attacker renames one file. Does it still fire? Nov 12, live, 4h: one Windows malware investigation, from triage to an Elastic detection that survives bypass testing. Hands-on, in your own lab. $59 + $59 voucher trainsec.net/detection-maste…
1
8
309
New video by @zodiacon: hiding a DLL by unlinking it from the PEB's loader module list. EnumProcessModules and WinDbg's !peb both miss it afterward. WinDbg's lm and Process Explorer still see it, because they scan the address space instead of walking the PEB. Read here: trainsec.net/library/windows…
3
150
Pavel just published: DLL Injection with SetWinEventHook. The accessibility event hook, used as an injector. He covers why you need a message pump, why the callback must be exported, and why only WINEVENT_INCONTEXT actually injects the DLL. Full write-up: trainsec.net/library/windows…
3
10
647
TrainSec Discord is about to cross 2,000 members. Two years ago this was a handful of students asking questions after a session. Today it's 2,000 people working across SOC teams, malware labs, kernel dev, and hardware benches. Thank you for building this with us. Let's put the community to work. We want to hear how cybersecurity actually happened for you: how you got into the field, a TrainSec course or masterclass that changed how you work, a hard problem you solved, a challenge the industry doesn't talk about enough. Whatever your story is, we want it public. How to take part 1. Write a post about your personal experience: cybersecurity employment, a TrainSec course, or a challenge you faced in the industry. 2. Post it publicly on LinkedIn, X, or any other public platform. 3. Tag @TrainSec (or Pavel, Uriel, Amichai) in the post. 4. Submit your post link here: forms.gle/9L78pHKQqeFEEPLS7. That's how we track entries and pick a winner. What you get - First 50 people to submit: choose a $59 TrainSec voucher or a free seat on our next Tiny Masterclass. - The single best story, picked by the TrainSec team and instructors: a $1,000 TrainSec voucher. Deadline: September 9, 2026 (two weeks from today). Winners announced here right after. There's no wrong way to tell your story. We just want to hear it. The TrainSec Team
4
1
3
351
Dear @TrainSec students, the winner of the discord community are @mimikaz7, @kaihi1293, @ronbaeh_drag. Emails were sent to the winners. Thank you for making this community great.
2
1
1
177
TrainSec Academy - Where pros train pros retweeted
How i got into cybersecurity @TrainSec It actually started with gaming. There was a time when i kept seeing cheaters everywhere (and ofc I was fed up with it...) and I was like: how the hell are they doing this ? (1)
2
1
1
188
TrainSec Academy - Where pros train pros retweeted
2
1
1
201
TrainSec Academy - Where pros train pros retweeted
My cybersecurity journey has included some challenges, especially while looking for stable full-time opportunities over the past year. I’m excited to keep learning, connect with the cybersecurity community, and turn that knowledge into real-world opportunities. @TrainSec
1
1
1
156
We are getting close to the deadline, make sure to update the application form.
1
104
TrainSec Academy - Where pros train pros retweeted
First and foremost, thank God. 🙏 The new Detection Engineering Professional course is selling amazingly! 😍🔥 And then I received this message: “This is the exact course I need right now as I am going to join as a detection engineer in few days.” THIS is exactly why I built it. Not another course where you just stare at slides. The workflow is: ATTACK → TELEMETRY → INVESTIGATION → DETECTION → TUNING → VALIDATION → BYPASS → Better DETECTION! You attack. You investigate. You understand the telemetry. You write the detection. You test it. You bypass it. Then you build a better detection. Seeing someone take the course just days before starting their Detection Engineering career makes all the work behind it worth it. ❤️ Thank you to everyone supporting the course. 🔥 Visit the course page here: trainsec.net/courses/detecti…
1
20
1
130
5,967
TrainSec Academy - Where pros train pros retweeted
🔥 MAoS: Malware Analysis on Steroids is now more accessible worldwide. I didn’t write MAoS to be another theoretical cybersecurity book. I wrote it to show what real malware analysis actually looks like. 🔬 Real malware investigations ⚙️ Real execution chains 🧬 Real persistence techniques 🖥️ Real artifacts 🔍 Real reverse engineering 🧠 Real analyst thinking I want malware analysts, SOC analysts, DFIR professionals, threat researchers and students around the world to be able to learn from these investigations. MAoS is now available on Amazon in all three formats: 📱 Kindle: Included with Kindle Unlimited, or $25.00 to buy 📕 Paperback: $39.99 📘 Hardcover: $49.99 If your malware analysis currently ends with: “Let’s upload it to a sandbox and see what happens…” MAoS is designed to take you much further. Learn how to actually investigate malicious code, understand its behavior, reverse engineer what matters and connect the technical artifacts together. 👉 amazon.com/dp/B0FQDGZGZW #MalwareAnalysis #ReverseEngineering #CyberSecurity
2
15
1
132
5,143
TrainSec Academy - Where pros train pros retweeted
🙏 First and foremost, I thank God for giving me the opportunity to present at DEF CON 34. A huge thank you to @defcon, Malware Village, and everyone who attended my workshop: “The Silent Tunneler - A Real-World Incident Response Story” 🔍 During the session, I walked through a real incident response investigation and demonstrated how the attacker operated inside the compromised environment. But we did not stop with simply analyzing what happened. ⚔️ I recreated the attacker’s behavior and TTPs in a controlled environment, generated the endpoint telemetry, investigated the evidence left behind, and translated that behavior into a practical Microsoft KQL detection rule. 🛡️ This is where incident response, attack simulation, threat hunting, and detection engineering come together: Attack. Observe. Investigate. Detect. Understanding an attack is important. Reproducing it, examining its telemetry, and building the detection that catches it is how we become better defenders. 🚀 In the coming days, my new SOC Analyst Professional - Attack and Defense course will be released. This hands-on training will take you through real-world attacker TTPs, the telemetry they generate, investigation techniques, and the process of building and validating practical detection rules. 👉 Join the waitlist now: trainsec.net/courses/soc-ana… Stay tuned!
2
20
1,867
TrainSec Academy - Where pros train pros retweeted
New video: Process Memory Map in Code (Part 1). VMMap shows you a process's memory layout from a GUI. This time I build a similar thing in code. Full write-up: trainsec.net/library/windows…
15
74
5,072
Want to connect with other cybersecurity professionals, researchers, and TrainSec Academy students? Join the TrainSec Academy Discord community 👇 We talk malware analysis, reverse engineering, DFIR, SOC, EDR internals, Windows Internals, offensive security, detection engineering, hardware hacking, and more. Ask questions, share research, discuss techniques, and learn together. Join here: discord.gg/3RqeHceaK
2
8
1,228
TrainSec Academy - Where pros train pros retweeted
Tomorrow at DEF CON 34! I'll be presenting at Malware Village: "The Silent Tunneler: A Real-World Incident Response Story" A 90-minute workshop based on a real incident response investigation, following the case from the very first anomaly, through the technical analysis, and into the full response process. Details: trainsec.net/library/malware…
6
24
1,569
TrainSec Academy - Where pros train pros retweeted
New CVE from Cipher Security Labs: CVE-2026-15929, an unauthenticated SQL injection in LG SmartShare DLNA Server v2.3.1712.1202. CVSS v4.0: 7.1 (High). Track our CVEs: ciphersecuritylabs.com/CVE-T…
11
15
142
411,612
TrainSec Academy - Where pros train pros retweeted
Sometimes a sample feels familiar before you can prove why. A function pattern. A naming habit. A weird implementation choice. A repeated mistake. That intuition is not random. It comes from exposure, structure, and memory. MAoS was written for analysts who want to build that layer intentionally. 📖 amazon.com/dp/B0FQDGZGZW If you want to sharpen your analytical instincts, take a look. #MalwareAnalysis #ReverseEngineering #ThreatResearch #MAoS
2
5
522