I started digging into Win32k callbacks while looking for a PatchGuard bypass. That lead went nowhere, but it raised a better question: how does the Windows kernel choose the callback for session-specific GUI work? idov31.github.io/posts/paint… 1/3

PyGroup3r - A Python port of Group3r — the Group Policy auditing tool by @mikeloss that authenticates with impacket so it runs from Linux, plus a filterable single-file HTML report on top of the original output formats github.com/S3cur3Th1sSh1t/Py…

We Turned On DNS Logging. Now Watch Me Walk Around It redhand.io/resources/dns-vis…

Windows Privilege Escalation Using NCSI Active Probes labs.itresit.es/2026/09/28/w…

Gentle reminder that earlier this year, I published an article containing a full purple team playbook with six procedures for blocking EDR traffic. ✅ Windows Filtering Platform ✅ Hosts File ✅ Routing Table ✅ Name Resolution Policy Table ✅ IPSec Filter Rules ✅ Secondary IP Addresses ipurple.team/2026/01/12/edr-…

If you are looking at cyber security training, I wrote an article to highlight 4 companies to follow/attend their trainings

ADE Skills - Adversarial Detection Engineering Knowledge Base ADE taxonomy, worked technique files, platform bug patterns, mitigations, and purple-team scoping tooling. github.com/Adversarial-Detec…

Build guide for Red Teaming home lab. GOAD lab setup in Proxmox and pfSense, Operator/C2, and Redirectors. github.com/pho5nix/Red-Team-…

InjectSetConsole - Performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the: ✅ VirtualAllocEx & ✅ WriteProcessMemory APIs github.com/TwoSevenOneT/Inje…

notRDP - A Havoc C2 plugin that creates an invisible alternate Windows desktop, streams it to a browser-based viewer, and supports full mouse/keyboard interaction like RDP, but invisible to the target user github.com/dagowda/notRDP

DDE Callback Hijacking - A Process Injection Technique medium.com/@jaytiwari05/dde-…

Cyber training.... 👇

MemGuard - Zero-Dependency LSASS Memory Shield & EDR Hook Detector github.com/prox0959/MemGuard

LocalStranger - create a driver mapper to map unsigned kernel drivers into kernel space, and a program to elevate the user to NT-AUTHORITY github.com/nbs32k/LocalStran…

Even more privileged ADCS ESC_CES adhdmurky.github.io/posts/po…

Purple Team Automation - Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&CK github.com/joshuagodwin7929/…

🎙️ Earlier this week, I wrote about the Dump Encoding Library case that was disclosed recently. 💭 Are ransomware groups going to use the WerEnc.dll library to perform the encryption in the future? Possibly. The full flow of the technique is displayed below: 🖊️ ipurple.team/2026/09/21/dump…