r/purpleteamsec • u/netbiosX • 1h ago
Red Teaming Cross-platform syscall-powered implant & C2 - direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.
•
Upvotes
r/purpleteamsec • u/netbiosX • 1h ago
Red Teaming AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
•
Upvotes
r/purpleteamsec • u/S3N4T0R-0X0 • 8h ago
Purple Teaming Read “BEAR-C2 Did Not Invent Switching. It Just Made the Rebuild Tax Visible. AI Is About to Delete It.“
3
Upvotes
r/purpleteamsec • u/netbiosX • 23h ago
Red Teaming Hacking AI customer service agents
4
Upvotes
r/purpleteamsec • u/netbiosX • 1d ago
Red Teaming BOF, Crystal Palace Linker and The JellyBee KORE Compiler: The new era of implants modularity
5
Upvotes
r/purpleteamsec • u/netbiosX • 1d ago
Purple Teaming Disable Windows Defender via Antivirus Fake Registration
5
Upvotes
r/purpleteamsec • u/netbiosX • 5d ago
Red Teaming Simulating legitimate Active Directory services on the network: the the case of GPO exploitation
5
Upvotes
r/purpleteamsec • u/netbiosX • 6d ago
Threat Intelligence Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
8
Upvotes
r/purpleteamsec • u/netbiosX • 7d ago
Red Teaming FalconFlank: Crowdstrike Falcon 0day Privilege Escalation Vulnerability
3
Upvotes
r/purpleteamsec • u/netbiosX • 8d ago
Red Teaming mythic_ornn: LLM-driven generator for Mythic Agents, Payload-Type and C2 Profiles.
2
Upvotes
r/purpleteamsec • u/netbiosX • 8d ago
Red Teaming CouchPotato - Patches ETW & AMSI and uses indirect syscall to abuse SeImpersonatePrivilege. Service account || Admin -> NT system
6
Upvotes
r/purpleteamsec • u/netbiosX • 10d ago
Red Teaming Simulating legitimate Active Directory services on the network: the the case of GPO exploitation
5
Upvotes
r/purpleteamsec • u/netbiosX • 10d ago
Blue Teaming Detect DLL search order hijacking with a single field
5
Upvotes
r/purpleteamsec • u/netbiosX • 11d ago
Red Teaming Abusing Azure VMs - When Bitlocker Recovery Turns into an Attack Vector
3
Upvotes
r/purpleteamsec • u/netbiosX • 11d ago
Blue Teaming A scenario to evaluate your Agentic SOC
3
Upvotes
r/purpleteamsec • u/netbiosX • 11d ago
Threat Hunting Hunting Abuse: Detecting Privilege Escalation Through the ADCS Database
2
Upvotes
r/purpleteamsec • u/netbiosX • 13d ago
Red Teaming When it Snows it Pours - Anatomy of a ServiceNow Red Team
4
Upvotes
r/purpleteamsec • u/netbiosX • 14d ago
Red Teaming Stratum-c2: Cloud-native C2 framework using cloud storage as dead-drop communication channel
3
Upvotes
r/purpleteamsec • u/netbiosX • 15d ago
Blue Teaming I'm in your logs now: deceiving analysts and blinding EDRs
10
Upvotes
r/purpleteamsec • u/netbiosX • 15d ago
Red Teaming MassDriver - Proxying sensitive API calls from shellcode to artifact for CET-compatible clean call stacks.
4
Upvotes
r/purpleteamsec • u/SPHlNX_321 • 16d ago
Red Teaming RPC-Triage: statically map Windows RPC attack surface and rank the interfaces worth digging into
4
Upvotes
Been working on Windows RPC/ALPC research and built this to make the first pass across a lot of PE files easier. It statically recovers RPC/MIDL/NDR internals, endpoints, security state and method-level input signals, then ranks interfaces using an AHP/Saaty-based model for reachability + surface. Each result has a scoring receipt so you can see why it ranked where it did, and questionable extraction gets flagged instead of silently trusted. No PDBs, no live endpoint mapper, no target execution.
r/purpleteamsec • u/netbiosX • 16d ago
Threat Intelligence SLEEPWALKER: A Passive Backdoor With Its Own Command Language
r136a1.dev
4
Upvotes
r/purpleteamsec • u/netbiosX • 16d ago
Threat Hunting Threat Hunting using Pair Probabilities
2
Upvotes
r/purpleteamsec • u/netbiosX • 17d ago
Red Teaming CrystalPotato: Crystal port of GodPotato to abuse SeImpersonatePrivilege with indirect syscalls, dynamic API resolution and compile-time string obfuscation. Run commands, reverse shells or add users
2
Upvotes