Posts

EDR Evasion: Process Injection Without WriteProcessMemory

DefenderWrite: Abusing Whitelisted Programs for Arbitrary Writes

Stealthy Persistence With Non-Existent Executable File

Windows Process Command Line Spoofing Through Symbolic Link

Path masquerading: Hide in plain sight

BYOVD to the next level. Blind EDR with Windows Symbolic Link

LOLBIN / LOLBAS – WinGet execute PowerShell script