_RastaMouse

I've added some YARA rules to the Crystal-Kit repo, covering both the loader and the tradecraft PICO. I was pleasantly surprised to see the generator target aspects like heap obfuscation, call stack spoofing, CFG bypass, and memory cleanup.

github.com/rasta-mouse/...

Breaking content signatures with 'ised' This is "Breaking content signatures with 'ised'" by AFF-WG on Vimeo, the home for high quality videos and the people who love them.

So, when I was writing my latest blog post, a few typos got in there. It's how you know I wrote it. :)

I really wanted to ship that day. The engineering was solid though. I put serious tortured (over-)thinking into the design & impl. decisions. I'm thrilled with the result.

vimeo.com/1170068618

[BLOG]
Islands of Invariance
rastamouse.me/islands-of-i...

A scalpel, a hammer, and a foot gun Last month, I released a Yara signature generator for Crystal Palace. AKA, an invariant content observation tool. I then used the feature to document the physics of various content-signature parame…

A Scalpel, A Hammer, and a Foot Gun

aff-wg.org/2026/03/03/a...

Havoc Professional Release The initial release of the long awaited Havoc Professional and the Kaine-kit is finally here and new team member.

Havoc Professional Finally Released! 🕸️🕷️

I'm excited to finally share the work my team and I have put in over the past year. This is just the beginning of what we have planned.

www.infinitycurve.org/blog/release

Punching Sideways While I no longer work in the C2 space and I don’t consider myself up on the operations side of red teaming, I watch the space closely to see where it’s going. In this post, I want to write about a…

Punching Sideways

aff-wg.org/2026/02/23/p...

This is now committed along with a few other changes like using the newer CPL Java API.

Working on a small improvement to Crystal Kit - masking heap memory.

I like Sleep

MAE - Malwareless Adversary Emulation Advanced red team training — 13 modules on adversary emulation without traditional malware. Learn the techniques that bypass modern defences.

Today’s the day, finally got around to publishing my red team course, with video, written and self spin up labs. lms.zsec.red

Part 2 of @tiraniddo.dev’s Windows Administrator Protection journey is here!

projectzero.google/2026/02/wind...

I've been playing with a C2 built around PIC modularity for the last few weeks. C2 comms are merged into the agent at link time and output as shellcode. COFFs are transformed into PICOs for postex. Evasion tradecraft can be woven in via spec files. Very scriptable using Sleep.

Next week at WWHF Mile High I'll present a major update to roadrecon, with some awesome features I wanted to add for a while! Friday 9am in track 1 for those attending 😀

The Islands of Invariance Crystal Palace now has a Yara rule generator. In this blog post, I’ll walk you through the design and evaluation of this feature. rule PageStream_rDLL_03495de1 { meta: description = “PageStre…

The Islands of Invariance

More than I ever thought I'd write about Yara signatures. Oh also, Crystal Palace has a Yara rule generator too.

aff-wg.org/2026/02/02/t...

Practical Threat Hunting for Beginners Learn the core knowledge and practical skills required to perform effective threat hunting in real-world environments.

I've released my new course:
Practical Threat Hunting for Beginners

Similar courses: $$$$
This course: $$

academy.bluraven.io/course/pract...

#ThreatHunting #DetectionEngineering

Playing in the (Tradecraft) Garden of Beacon and finding Eden. In our latest blog, learn how to utilize Crystal Palace, an open source project from Cobalt Strike creator Raphael Mudge, to rapidly combine different capabilities to create novel loaders/PIC tradecraft.

https://ow.ly/zxMP50Y1NQ5

A nice workaround against my YARA rule.
kuwaitist.github.io/posts/Patchi...

Nice!

v0.0.2 of crystal-palace-vsc is up
marketplace.visualstudio.com/items?itemNa...

In addition to some new commands, this post goes into a lot of details regarding Crystal Palace's binary transformations. If you're interested in how it does some things under-the-hood, give this a read.

Keeping bin2bin out of the bin Happy New Year. I’ve got another Crystal Palace and Tradecraft Garden update for you. My focus this development cycle was making Crystal Palace’s binary transformation framework more robust. …

Keeping bin2bin out of the bin

aff-wg.org/2026/01/13/k...

Another TCG update. +shatter, +regdance, and -O1 MinGW support.

Bigger emphasis in this cycle was hardening the binary transformation foundation--which led to some adventures (details in the post)

BOF Cocktails Crystal Palace is a PIC framework that can be used to write, among other things, prepended DLL loaders. The philosophy of the project is to apply evasion tradecraft (also written as PIC), to a capabil...

[BLOG]
BOF Cocktails
rastamouse.me/bof-cocktails/

Pokemon Yellow Ash% :: 2:27 IGT :: TAS YouTube video by avatar00000

My alter ego has posted a TAS for the Pokémon Yellow Ash% route. Check it out if you like a bit of retro-gaming.
www.youtube.com/watch?v=SqFU...

Works!

I managed it: marketplace.visualstudio.com/items?itemNa...

Sure, makes sense. You can't just leave the APIs in this scenario though, because Crystal Palace throws the error "Function xxx is not in MODULE$Function format". Maybe we need a new command to skip relocating specified functions? Or maybe some other way to deal with it that fits with your plans.

The idea was to merge hooks into a BOF, 'make coff', then run via beacon_inline_execute. I don't think we want to attach the Beacon BOF APIs to funcs within the merged COFF though. What would you attach them to? Can't we just leave/ignore them so Beacon can link them to the proper internal funcs?

I've written a VSCode extension that provides syntax highlighting for Crystal Palace spec files. I'll throw it up on the marketplace if I can figure out how 😅

How are we handling BeaconOutput, BeaconPrintf, etc with a COFF object?

GitHub - pard0p/Remote-BOF-Runner: Remote BOF Runner is a Havoc extension framework for remote execution of Beacon Object Files (BOFs) using a PIC loader made with Crystal Palace. Remote BOF Runner is a Havoc extension framework for remote execution of Beacon Object Files (BOFs) using a PIC loader made with Crystal Palace. - pard0p/Remote-BOF-Runner

To wrap up the year, I've published this Havoc extension that enables remote execution of Beacon Object Files (BOFs) using a PIC loader built with Crystal Palace.

github.com/pard0p/Remot...