offensive security - windows internals | BlueSky: bsky.app/profile/splintercod… | Mastodon: infosec.exchange/@splinter_c…
Italy
- Tweets 1,815
- Following 324
- Followers 9,343
- Likes 2,622
Pinned Tweet
The slides of our joint research talk “10 Years of Windows Privilege Escalation with Potatoes” at #POC2023 are out!
👉 github.com/antonioCoco/infos…
cc @decoder_it
4
147
375
47,961
Antonio Cocomazzi retweeted
> A new Project Zero blog post by James Forshaw
projectzero.google/2026/02/g…
Me: Oh hey, I recognize this function! UIAccess + GetProcessHandleFromHwnd / NtUserGetWindowProcessHandle were the core of my CVE-2021-31951 EoP 😋
So some fixes leading to v3 actually date a bit earlier
1
11
76
4,342
Antonio Cocomazzi retweeted
@decoder_it breaks down reflection attacks and their impact on enterprise security in this new talk at #INSO26. Are you interested in how modern authentication flow works? So this talk is for you!
Save your spot: ow.ly/cCr450Ykak4
#Infosec #INSO26 #CyberConference
4
6
1,238
Antonio Cocomazzi retweeted
Just dropped a short post on why some classic NTLM relay tricks seems to be dead on Server 2025.
decoder.cloud/2026/02/25/wha…
2
64
198
14,082
Antonio Cocomazzi retweeted
Just published a summary of "modern" Windows authentication reflection attacks. Turns out reflection never really died. 😅decoder.cloud/2025/11/24/ref…
3
79
228
20,773
Antonio Cocomazzi retweeted
Blog post about my recent CVE-2025-58726, aka “The Ghost Reflection” is out, read it here:
semperis.com/blog/exploiting…
🙃
3
89
179
16,848
Antonio Cocomazzi retweeted
Remember the CredMarshalInfo trick? If you hadn’t applied the June 2025 patch, CVE-2025-33073 would have been critical. We know that in NTLM local auth, msg 3 is empty:You can drop sign/seal -> from Domain User to DomainAdmin escalation. 😅
5
63
222
18,754
Antonio Cocomazzi retweeted
Coercing machine authentication on Windows 11 /2025 using the MS-PRN/PrinterBug DCERPC edition, since named pipes are no longer used.
Kerberos fails in this case due to a bad SPN from the spooler, forcing NTLM fallback.
4
81
278
19,186
Antonio Cocomazzi retweeted
Better socket handle visibility coming soon to @SystemInformer 🔥
When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩
2
21
115
12,494
I’m hiring Staff Windows Security Researchers to join my XAT (eXploits and Anti-Tampering) team at @SentinelOne! 🔥
👉 sentinelone.com/jobs/?gh_jid…
More details 👇
1
2
9
3,164
The role is opened in multiple locations in Europe (we’re hiring across Italy, Spain, Poland, Czech Republic, Slovakia and France), with optional relocation support to Czechia if you'd prefer to move (must be eligible to work in the EU already at the time of applying).
1
607
Apply here → sentinelone.com/jobs/?gh_jid…
Happy to chat if you want to learn more.
571
Antonio Cocomazzi retweeted
In my long history of submissions, I think this is the first time one has been marked as critical😅
3
1
83
6,338
Antonio Cocomazzi retweeted
Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you!
Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-conferenc…
#infosec #securityconference
ALT Romhack2025 agenda
11
34
11,134
Antonio Cocomazzi retweeted
I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…
2
149
349
19,763
Antonio Cocomazzi retweeted
Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets. msft.it/6019qIVV9
9
115
297
71,503
Antonio Cocomazzi retweeted
NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs.
Read my detailed post - the most comprehensive guide on NTLM relay & the new edges:
ghst.ly/4lv3E31
6
110
256
21,591
Antonio Cocomazzi retweeted
We (me + @2igosha) have discovered a new Google Chrome 0-day that is being used in targeted attacks to deliver sophisticated spyware 🔥🔥🔥. It was just fixed as CVE-2025-2783 and we are revealing the first details about it and “Operation ForumTroll” securelist.com/operation-for…
9
94
279
37,753
Antonio Cocomazzi retweeted
Check out our new blog post!
🍎🚨🕵️♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix.
📄 This new research from SentinelOne exposes how these new variants are spreading and how you can protect your organization. Stay informed. Stay secure. Dive into the research: s1.ai/readup
1
5
12
1,662