@natesubra.com
Adversary Simulation, Red Team Lead, Security Research @ LFI Posts are my own He/Him #redteam #offsec #malware #cybersecurity https://secdsm.org I use my real name. The trick is figuring out my handles @natesubra@infosec.exchange
"emerald-template is a CMake-based project template designed for developing and debugging Reflective DLL Loaders using the Crystal Palace linker."
"This allows for source-code level debugging of your loader logic from Windows (and theoretically Linux) systems"
github.com/0xTriboulet/...
PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible to build a multi-stage and modular C2 implant made of PICOs.
github.com/pard0p/PICO-...
LibIPC is a simple Crystal Palace shared library for inter-process communication, based on Named Pipes.
github.com/pard0p/LibIPC
Blog post about my recent CVE-2025-58726, aka “The Ghost Reflection” is out, read it here:
semperis.com/blog/exploit...
🙃
LibGate - a Crystal Palace shared library for resolving and performing syscalls github.com/rasta-mouse/...
def con 34 and 35 save the date calendar image
Good News, Everyone! We have the official dates for #DEFCON34! And to make up for the delay, we also have the dates for #DEFCON35!
Please join us at the Las Vegas Convention Center August 6-9 in 2026 and August 5-8 in 2027.
Save the dates, friends. It'll be here before you know it.
#defcon
NTLM relay research is evolving!
Join Nick Powers & @tw1sm.bsky.social TOMORROW as they share new methods to enumerate EPA enforcement across MSSQL, HTTP, & more—and intro RelayInformer, expanding attacker-perspective coverage for key protocols.
Grab your spot → ghst.ly/oct-web-bsky
And it's released! 🎉
github.com/ofasgard/exe...
I've tested it with Rubeus and Seatbelt and a variety of different arguments, and it seems to be pretty stable as far as I can tell. If anyone uses this PICO and encounters bugs or instability, please let me know!
1 little known secret of help.exe
www.hexacorn.com/blog/2025/10...
Pop a vendor website, replace their /.well-known/security.txt with your own rogue contact info, and wait for the bugs to roll in.
Why plant a Tradecraft Garden?
April 2025, I talked to my camera about how tradecraft may go the route we saw vuln research go years ago, red teaming's retreat to self-protective secrecy, and the opportunity I see for a public tradecraft ecosystem. This starts @ 1:16:00
vimeo.com/1074106659#t...
MacroPack v2.8.7 is out!
New GUI & updated EDR evasion! New features include Advanced LNK spoofing, expanded .NET obfuscation, and ML-evasion.
For authorized red-team use!
#RedTeam #offensivesecurity
Working on a fun Crystal Palace loader that hooks APIs and pushes them through a call stack spoofing PICO.
RunDll Exporters
www.hexacorn.com/blog/2025/09...
Win32_Process has been the go to WMI class for remote command execution for years.
Steven Flores explores a new WMI class that functions like Win32_Process and offers further capability. Read more: ghst.ly/4gyPbkr
This report from @interseclab.bsky.social on how a Chinese company is exporting some of the capabilities of "The Great Wall of China" to other autocratic countries is INSANELY INTERESTING:
interseclab.org/wp-content/u...
*EVERY Page is worth reading*
Some interesting tidbits in the thread
DLL ForwardSideloading
www.hexacorn.com/blog/2025/08...
using forwarded DLL functions for sideloading purposes
DLL ForwardSideloading, Part 2
www.hexacorn.com/blog/2025/09...
The DSInternals PowerShell module just got an upgrade! 🔥
Updates include:
✅ Golden dMSA Attack
✅ Full LAPS support
✅ Trust password & BitLocker recovery key extraction
✅ Read-only domain controller database compatibility
Read more from Michael Grafnetter: ghst.ly/412rZ7F
The AD CS security landscape keeps evolving, and so does our tooling. 🛠️
Valdemar Carøe drops info on Certify 2.0, including a suite of new capabilities and refined usability improvements. ghst.ly/45IrBxI
BloodHound 8.0 is here.
A big leap forward in identity security prevention.
Now we’re able to model attack paths across the entire modern enterprise stack.
Our folks will be at #BlackHat next week to show off a few examples. Check it out:
We’re trying something new.
www.preludesecurity.com/runtime-memo...
[BLOG]
Integrating Tradecraft Garden PIC loaders into Cobalt Strike
rastamouse.me/harvesting-t...
Voice clones are easy.
Be suspicious even if a call appears to be from someone you know.
Also…Don’t set up voice authentication for banking.
SentinelOne experienced hours-long outages today.
"Customer endpoints are still protected at this time, but managed response services will not have visibility," per blog post.
"Our initial RCA suggests this is not a security incident."
www.sentinelone.com/blog/update-...
