Signet - a code signing wrapper for Mythic C2. It takes any wrapped agent binary or uploaded file and applies an Authenticode signature via osslsigncode. github.com/Whispergate/Signe…
Panos Gkatziroulis 🦄 retweeted
Local Shellcode Execution via SetupIterateCabinetW
New Medium post, today we are going to explore a shellcode execution technique that abuses SetupIterateCabinet (a Cabinet file enumeration function) to dispatch shellcode through a file callback pointer
medium.com/@s12deff/local-sh…
Panos Gkatziroulis 🦄 retweeted
I wrote an article about the technique that was disclosed some years ago by @mrd0x - Custom Extensions, including detection opportunities.
TL;DR: Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious file as a legitimate file or evade Windows SmartScreen.
🖊️ ipurple.team/2026/10/22/cust…
Grateful for the recent conversations we've had with @techspence and @alehurtadoxo
youtu.be/INz5r8a1-6w?si=EnvL…
xitter.cf/alehurtadoxo/status/21…
Definitely give them a view and a subscribe. Lots more inbound friends
I had two of the founding fathers of detection engineering on Detection Dispatch to talk about what they've been farming with the community. 🌱
LOLDrivers. LOLRMM. LOLSkills.
Catalogs that track legitimate tools and components that attackers abuse, giving us a shared place to build knowledge, hunt, and detection engineer the ways of prevention.....but the conversation went somewhere I didn't expect.
I've spent so much of my career thinking about detection that this episode genuinely had me rewiring my brain around app control/prevention....Prevention isn't a replacement for detection. We need both, and I think we need to talk a lot more about how they work together. That's the episode, you don't want to miss.
Thank you @M_haggis & @_josehelps for the laughs 🦉 🦉 🦉 🦉
Full episode dropping this weekend, subscribe to my Youtube channel to be notified 🔔
All you need to know about JA3 & JA4 Fingerprints (and how to collect them) medium.com/@ggabrielhd/all-y…
Panos Gkatziroulis 🦄 retweeted
Telling folks cyber is that serious and this week we saw why. 🥲
Sharing the panel with @OpenAI ✨
FYI, the invite expires in 3H ⤵️
There are updates in the iPurple Discord server today, with more planned later today.
Whether you're on the red, purple, or blue team side, feel free to join us.
⏰ Invite Expires in 24H
➡️ discord.gg/XmJCvkbT
I wrote an article about the technique that was disclosed some years ago by @mrd0x - Custom Extensions, including detection opportunities.
TL;DR: Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious file as a legitimate file or evade Windows SmartScreen.
🖊️ ipurple.team/2026/10/22/cust…
While everybody is prompting for PHP, recently I ended up having to dump the LSA in a custom way.
I have written a short article on the entire LSA decryption stack, with the C implémentation. 💫
Cross posted here blog.advens-c.tf/articles/ls… and here hideandsec.sh/books/windows-…
From Boot Key to Plaintext: How Windows LSA Secrets Are Deciphered from the Registry hideandsec.sh/books/windows-…
There are updates in the iPurple Discord server today, with more planned later today.
Whether you're on the red, purple, or blue team side, feel free to join us.
⏰ Invite Expires in 24H
➡️ discord.gg/XmJCvkbT
Hiding a DLL from the PEB Loader List (And Why Process Explorer Still Sees It) trainsec.net/library/windows…
Panos Gkatziroulis 🦄 retweeted
Replying to @ipurple @_JohnHammond
100% agree. Skilled humans with domain specific knowledge still need to ask the right questions, and evaluate answers - AI is an agent not an actor and cant generate its own intent or motivation. AI isnt replacing anyone with domain specific knowledge. Learning is still valuable.
A project that uses Confluence as a C2 🧐
github.com/dagowda/Confluenc…












