Ex-theoretical physicist, currently terrible hacker and wannabe security researcher. Views are, regrettably, my own. Likes = bookmarks
Joined September 2014
- Tweets2K
- Following4K
- Followers2.3K
- Likes18.8K
Pinned Tweet
Ever wanted to make your sketchy sys calls look squeaky clean? I wrote a blog demonstrating a PoC which calls NtOpenProcess to grab a handle to lsass with an arbitrary/spoofed call stack: labs.withsecure.com/blog/spo…
PoC: github.com/countercept/CallS…
William Burgess retweeted
Did you know that Windows processes fundamental to Operating System security run in Isolated User Mode and can not be debugged ?
Well that's true except when it isn't.
Here @fdfalcon provides a step by step guide to do it
blog.quarkslab.com/debugging…
#Windows #ReverseEngineering
ALT Debugging vmsp.exe in VTL1 with nested virtualization and binary patching. The Way of The Cracker
William Burgess retweeted
An internal OpenAI model has disproved one of the most well-known Erdős problems: the unit distance problem.
This is, without doubt, the most impressive achievement of AI in mathematics so far.
openai.com/index/model-dispr…
[BLOG] Playing in the (Tradecraft) Garden of Beacon: Finding Eden - cobaltstrike.com/blog/playin…
William Burgess retweeted
PDFSIDER Malware - Exploitation of DLL Side-Loading for AV and EDR Evasion resecurity.com/blog/article/…
William Burgess retweeted
Blog post: On the Coming Industrialisation of Exploit Generation with LLMs sean.heelan.io/2026/01/18/on…
TL;DR: I ran an experiment with GPT-5.2 and Opus 4.5 based agents to generate exploits for a zeroday QuickJS bug. They're pretty good at it.
Code: github.com/SeanHeelan/anamne…
William Burgess retweeted
[New @originhq blog+POC]
No PPL? No problem!
SecurityTrace, an undocumented ETW feature, restricts some AutoLogger traces to PPL only — yet we found this current design still allows non-PPL processes to consume from Threat-Intelligence as admin only!
originhq.com/blog/securitytr…
William Burgess retweeted
Want to consume Microsoft-Windows-Threat-Intelligence but Antimalware-PPL getting you down? No problem! I will post a blog & POC soon - but this allows you to consume Threat-Intelligence without PPL _and_ w/o any kernel patching/driver loading gymnastics! Only need admin!
William Burgess retweeted
Cobalt Strike 4.12 is LIVE, complete with a new look for the GUI! Additionally, we're introducing:
- A REST API
- User Defined Command and Control (UDC2)
- New process injection options
- New UAC bypasses
- and more!
Check out the release blog for details.
ow.ly/RSmE50Xx1OS
A looot in this but if (like me) you’re a fan of custom egress channels ala extc2 this will be of particular interest 👀
Cobalt Strike 4.12 is LIVE, complete with a new look for the GUI! Additionally, we're introducing:
- A REST API
- User Defined Command and Control (UDC2)
- New process injection options
- New UAC bypasses
- and more!
Check out the release blog for details.
ow.ly/RSmE50Xx1OS
William Burgess retweeted
New Blog: Based on his talk at Black Hat, @0xTriboulet discusses integrating Windows AI/ML APIs into Cobalt Strike’s workflows and presents proof-of-concept implementations for AI-augmented post-exploitation capabilities in Cobalt Strike.
ow.ly/8hSO50WWTSW
William Burgess retweeted
Exciting times. I'm publishing Dittobytes today after presenting it at @OrangeCon_nl !
Dittobytes is a true metamorphic cross-compiler aimed at evasion. Use Dittobytes to compile your malware. Each compilation produces unique, functional shellcode.
github.com/tijme/dittobytes
I will be presenting at Beacon conf next week on “Linkers and Loaders: Experiments with Crystal Palace”. If you enjoy filthy PIC tradecraft it may be of interest! eventbrite.co.uk/e/beacon-25…
William Burgess retweeted
I am excited for us to finally share our fully user-mode detection agent research preview!
Intel Processor Trace, Last Branch Record, thread scheduler and PMU telemetry all from user-mode, using the latest Windows features!
Announcing our whitepaper on the future of endpoint security.
preludesecurity.com/runtime-…
William Burgess retweeted
Published a small collection of PIC loaders for Cobalt Strike, based on my experiments with Crystal Palace.
github.com/rasta-mouse/Cryst…
William Burgess retweeted
Chrome Remote Desktop can offer red teamers a subtle way to bypass restrictions—if they know how to use it. In this blog, @Oddvarmoe reveals a practical guide to repurposing Chrome Remote Desktop on red team operations. Read it now! trustedsec.com/blog/abusing-…
William Burgess retweeted
I'm finally releasing a project that I've been working on for a little while now. Here's Boflink, a linker for Beacon Object Files. github.com/MEhrn00/boflink
Supporting blog post about it. blog.cybershenanigans.space/…
William Burgess retweeted
[BLOG]
Integrating Tradecraft Garden PIC loaders into Cobalt Strike
rastamouse.me/harvesting-the…
[BLOG] Dynamically Instrumenting Beacon with BeaconGate - For All Your Call Stack Spoofing Needs! cobaltstrike.com/blog/instru…
