
Learn Windows Internals, Malware Analysis, Malware Development, Hardware Hacking & Code Development from @UrielKosayev, @zodiacon & @The_H1tchH1ker
Joined August 2023
- Tweets559
- Following85
- Followers1K
- Likes678
New live masterclass: Malware Analysis to Detection Engineering with Uriel Kosayev.
One Windows malware investigation, from triage to an Elastic detection that survives bypass testing. Hands-on, 4 hours.
Nov 12, 15:00 UTC.
Your detection fired in the lab. Now the attacker renames one file. Does it still fire?
Nov 12, live, 4h: one Windows malware investigation, from triage to an Elastic detection that survives bypass testing. Hands-on, in your own lab.
$59 + $59 voucher
trainsec.net/detection-maste…
New video by @zodiacon: hiding a DLL by unlinking it from the PEB's loader module list.
EnumProcessModules and WinDbg's !peb both miss it afterward. WinDbg's lm and Process Explorer still see it, because they scan the address space instead of walking the PEB.
Read here: trainsec.net/library/windows…
Pavel just published: DLL Injection with SetWinEventHook.
The accessibility event hook, used as an injector. He covers why you need a message pump, why the callback must be exported, and why only WINEVENT_INCONTEXT actually injects the DLL.
Full write-up: trainsec.net/library/windows…
A detection that worked yesterday can miss the same attack today.
@UrielKosayev on detection engineering for Blue, Purple and Red Team, plus a five-step cycle: Simulate, Investigate, Detect, Tune, Validate.
trainsec.net/library/cyber-d…
TrainSec Discord is about to cross 2,000 members.
Two years ago this was a handful of students asking questions after a session. Today it's 2,000 people working across SOC teams, malware labs, kernel dev, and hardware benches. Thank you for building this with us.
Let's put the community to work.
We want to hear how cybersecurity actually happened for you: how you got into the field, a TrainSec course or masterclass that changed how you work, a hard problem you solved, a challenge the industry doesn't talk about enough. Whatever your story is, we want it public.
How to take part
1. Write a post about your personal experience: cybersecurity employment, a TrainSec course, or a challenge you faced in the industry.
2. Post it publicly on LinkedIn, X, or any other public platform.
3. Tag @TrainSec (or Pavel, Uriel, Amichai) in the post.
4. Submit your post link here: forms.gle/9L78pHKQqeFEEPLS7. That's how we track entries and pick a winner.
What you get
- First 50 people to submit: choose a $59 TrainSec voucher or a free seat on our next Tiny Masterclass.
- The single best story, picked by the TrainSec team and instructors: a $1,000 TrainSec voucher.
Deadline: September 9, 2026 (two weeks from today). Winners announced here right after.
There's no wrong way to tell your story. We just want to hear it.
The TrainSec Team
Dear @TrainSec students, the winner of the discord community are @mimikaz7, @kaihi1293, @ronbaeh_drag.
Emails were sent to the winners.
Thank you for making this community great.
TrainSec Academy - Where pros train pros retweeted
My cybersecurity journey has included some challenges, especially while looking for stable full-time opportunities over the past year. I’m excited to keep learning, connect with the cybersecurity community, and turn that knowledge into real-world opportunities.
@TrainSec
New at TrainSec: Detection Engineering Professional with @UrielKosayev
Simulate the attack. Trace the telemetry. Write the rule. Then try to bypass it.
147 lessons. Sysmon, Elastic Defend, KQL.
Scholarships available.
trainsec.net/courses/detecti…
TrainSec Academy - Where pros train pros retweeted
First and foremost, thank God. 🙏
The new Detection Engineering Professional course is selling amazingly! 😍🔥
And then I received this message:
“This is the exact course I need right now as I am going to join as a detection engineer in few days.”
THIS is exactly why I built it.
Not another course where you just stare at slides.
The workflow is:
ATTACK → TELEMETRY → INVESTIGATION → DETECTION → TUNING → VALIDATION → BYPASS → Better DETECTION!
You attack.
You investigate.
You understand the telemetry.
You write the detection.
You test it.
You bypass it.
Then you build a better detection.
Seeing someone take the course just days before starting their Detection Engineering career makes all the work behind it worth it. ❤️
Thank you to everyone supporting the course. 🔥
Visit the course page here: trainsec.net/courses/detecti…
TrainSec Academy - Where pros train pros retweeted
🔥 MAoS: Malware Analysis on Steroids is now more accessible worldwide.
I didn’t write MAoS to be another theoretical cybersecurity book.
I wrote it to show what real malware analysis actually looks like.
🔬 Real malware investigations
⚙️ Real execution chains
🧬 Real persistence techniques
🖥️ Real artifacts
🔍 Real reverse engineering
🧠 Real analyst thinking
I want malware analysts, SOC analysts, DFIR professionals, threat researchers and students around the world to be able to learn from these investigations.
MAoS is now available on Amazon in all three formats:
📱 Kindle: Included with Kindle Unlimited, or $25.00 to buy
📕 Paperback: $39.99
📘 Hardcover: $49.99
If your malware analysis currently ends with:
“Let’s upload it to a sandbox and see what happens…”
MAoS is designed to take you much further.
Learn how to actually investigate malicious code, understand its behavior, reverse engineer what matters and connect the technical artifacts together.
👉 amazon.com/dp/B0FQDGZGZW
#MalwareAnalysis #ReverseEngineering #CyberSecurity
TrainSec Academy - Where pros train pros retweeted
🙏 First and foremost, I thank God for giving me the opportunity to present at DEF CON 34.
A huge thank you to @defcon, Malware Village, and everyone who attended my workshop:
“The Silent Tunneler - A Real-World Incident Response Story”
🔍 During the session, I walked through a real incident response investigation and demonstrated how the attacker operated inside the compromised environment.
But we did not stop with simply analyzing what happened.
⚔️ I recreated the attacker’s behavior and TTPs in a controlled environment, generated the endpoint telemetry, investigated the evidence left behind, and translated that behavior into a practical Microsoft KQL detection rule.
🛡️ This is where incident response, attack simulation, threat hunting, and detection engineering come together:
Attack. Observe. Investigate. Detect.
Understanding an attack is important. Reproducing it, examining its telemetry, and building the detection that catches it is how we become better defenders.
🚀 In the coming days, my new SOC Analyst Professional - Attack and Defense course will be released.
This hands-on training will take you through real-world attacker TTPs, the telemetry they generate, investigation techniques, and the process of building and validating practical detection rules.
👉 Join the waitlist now:
trainsec.net/courses/soc-ana…
Stay tuned!
TrainSec Academy - Where pros train pros retweeted
New video: Process Memory Map in Code (Part 1).
VMMap shows you a process's memory layout from a GUI. This time I build a similar thing in code.
Full write-up: trainsec.net/library/windows…
Tomorrow, 15:00 UTC: @zodiacon (Pavel Yosifovich) teaches Linux Internals Fundamentals for Windows Professionals. 4 hours, live, hands-on. $59. A few seats left.. Recording will be avaliable to registered students.
trainsec.net/events/linux-in…
Want to connect with other cybersecurity professionals, researchers, and TrainSec Academy students?
Join the TrainSec Academy Discord community 👇
We talk malware analysis, reverse engineering, DFIR, SOC, EDR internals, Windows Internals, offensive security, detection engineering, hardware hacking, and more.
Ask questions, share research, discuss techniques, and learn together.
Join here:
discord.gg/3RqeHceaK
TrainSec Academy - Where pros train pros retweeted
Tomorrow at DEF CON 34!
I'll be presenting at Malware Village:
"The Silent Tunneler: A Real-World Incident Response Story"
A 90-minute workshop based on a real incident response investigation, following the case from the very first anomaly, through the technical analysis, and into the full response process.
Details:
trainsec.net/library/malware…
TrainSec Academy - Where pros train pros retweeted
New CVE from Cipher Security Labs: CVE-2026-15929, an unauthenticated SQL injection in LG SmartShare DLNA Server v2.3.1712.1202. CVSS v4.0: 7.1 (High).
Track our CVEs: ciphersecuritylabs.com/CVE-T…
TrainSec Academy - Where pros train pros retweeted
Sometimes a sample feels familiar before you can prove why.
A function pattern.
A naming habit.
A weird implementation choice.
A repeated mistake.
That intuition is not random.
It comes from exposure, structure, and memory.
MAoS was written for analysts who want to build that layer intentionally.
📖 amazon.com/dp/B0FQDGZGZW
If you want to sharpen your analytical instincts, take a look.
#MalwareAnalysis #ReverseEngineering #ThreatResearch #MAoS














