netbiosX

@netbiosx.bsky.social

Purple Team

1,754 Followers | 66 Following | 270 Posts | Joined: 03.07.2023 | 1.5438

Latest posts by netbiosx.bsky.social on Bluesky

Lateral Movement – BitLocker BitLocker is a full disk encryption feature which was designed to protect data by providing encryption to entire volumes. In Windows endpoints (workstations, laptop devices etc.), BitLocker is typi…

04.08.2025 18:29 — 👍 1 🔁 0 💬 0 📌 0

Takedown

03.08.2025 16:51 — 👍 1 🔁 0 💬 0 📌 0

BadSuccessor Microsoft has introduced a feature in Windows Server 2025 to prevent credential harvesting via Kerberoasting and other credential stuffing attacks. This new feature comes in the form of a new accou…

28.07.2025 14:13 — 👍 0 🔁 0 💬 0 📌 0

The Ultimate Guide to Windows Coercion Techniques in 2025 Windows authentication coercion often feels like a magic bullet against the average Active Directory. With any old low-privileged account, it usually allows us to gain full administrative access to al...

05.06.2025 17:35 — 👍 2 🔁 1 💬 0 📌 0

Boflink: A Linker For Beacon Object Files Intro This is a blog post written for a project I recently released. The source code for it can be found here on Github. Background The design of Cobalt Strike’s Beacon Object Files is rather unique w...

31.05.2025 16:48 — 👍 1 🔁 1 💬 0 📌 0

Stealth Syscall Execution: Bypassing ETW, Sysmon, and EDR Detection "Stealth syscalls: Because life's too short to argue with an angry EDR!" Discover how Stealth Syscall Execution bypasses ETW, Sysmon, and EDR detection. Learn advanced stealth techniques for red teami...

31.05.2025 10:52 — 👍 6 🔁 2 💬 0 📌 0

Revisiting COM Hijacking - SpecterOps Learn how to use COM hijacking for persistence and post-exploitation by targeting commonly used applications in Windows environments.

28.05.2025 18:42 — 👍 3 🔁 1 💬 0 📌 0

GitHub - EvilBytecode/Ebyte-AMSI-ProxyInjector: A lightweight tool that injects a custom assembly proxy into a target process to silently bypass AMSI scanning by redirecting AmsiScanBuffer calls. It s... A lightweight tool that injects a custom assembly proxy into a target process to silently bypass AMSI scanning by redirecting AmsiScanBuffer calls. It suspends the target’s threads, patches the fun...

17.05.2025 09:55 — 👍 1 🔁 0 💬 0 📌 0

Living-off-the-COM: Type Coercion Abuse This technique leverages PowerShell’s .NET interop layer and COM automation to achieve stealthy command execution by abusing implicit type…

16.05.2025 19:15 — 👍 4 🔁 1 💬 0 📌 0

GitHub - Thunter-HackTeam/EvilentCoerce Contribute to Thunter-HackTeam/EvilentCoerce development by creating an account on GitHub.

06.05.2025 21:43 — 👍 0 🔁 0 💬 0 📌 0

Beacon Object Files vs Tiny EXE Files TL;DR A lot of bloat in an EXE file is just the statically linked C runtime. Link dynamically to msvcrt.dll (or ucrtbase.dll on Win 10+) plus a 40-line stub, and depending on the size of the progra…

05.05.2025 16:03 — 👍 1 🔁 0 💬 0 📌 0

GitHub - quarkslab/proxyblob: SOCKS5 proxy tool that uses Azure Blob Storage as a means of communication. SOCKS5 proxy tool that uses Azure Blob Storage as a means of communication. - quarkslab/proxyblob

05.05.2025 13:02 — 👍 0 🔁 0 💬 0 📌 0

Writing your own RDI /sRDI loader using C and ASM In this post, I am going to show the readers how to write their own RDI/sRDI loader in C, and then show how to optimize the code to make it fully position independent.

28.04.2025 06:59 — 👍 0 🔁 0 💬 0 📌 0

Attacking and Defending Configuration Manager - An Attackers Easy Win Introduction System Center Configuration Manager (SCCM) or Microsoft Configuration Manager allows endpoint administrators to utilize a single platform for seamless device management inside of an Activ...

27.04.2025 18:22 — 👍 3 🔁 0 💬 0 📌 0

GitHub - backdoorskid/ClrAmsiScanPatcher: Patches the AmsiScan function in clr.dll allowing for unrestricted assembly loading in .NET Patches the AmsiScan function in clr.dll allowing for unrestricted assembly loading in .NET - backdoorskid/ClrAmsiScanPatcher

24.04.2025 20:43 — 👍 2 🔁 0 💬 0 📌 0

GitHub - cogiceo/GPOHound: Offensive GPO dumping and analysis tool that leverages and enriches BloodHound data Offensive GPO dumping and analysis tool that leverages and enriches BloodHound data - cogiceo/GPOHound

23.04.2025 17:27 — 👍 3 🔁 0 💬 0 📌 0

Windows Defender antivirus bypass in 2025 - part 2 Discover how hackers bypass an antivirus such as Windows Defender, using advanced techniques such as direct syscalls and shellcode encryption

22.04.2025 20:54 — 👍 0 🔁 0 💬 0 📌 0

Bypassing AMSI with Dynamic API Resolution in PowerShell - ROOTFU.IN function LookupFunc { Param ($moduleName, $functionName) $assem = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\')[-1]. Equals('System.dl...

21.04.2025 11:07 — 👍 1 🔁 1 💬 0 📌 0

GitHub - almounah/go-buena-clr: Good CLR Host with Native patchless AMSI Bypass Good CLR Host with Native patchless AMSI Bypass. Contribute to almounah/go-buena-clr development by creating an account on GitHub.

19.04.2025 11:57 — 👍 0 🔁 0 💬 0 📌 0

GitHub - tdeerenberg/InlineWhispers3: Tool for working with Indirect System Calls in Cobalt Strike's Beacon Object Files (BOF) using SysWhispers3 for EDR evasion Tool for working with Indirect System Calls in Cobalt Strike's Beacon Object Files (BOF) using SysWhispers3 for EDR evasion - tdeerenberg/InlineWhispers3

13.04.2025 23:37 — 👍 0 🔁 0 💬 0 📌 0

RemoteMonologue: Weaponizing DCOM for NTLM authentication coercions | IBM The IBM X-Force Red team covers the fundamentals of COM and DCOM, dives into the RunAs setting and why authentication coercions are impactful and introduces a new credential harvesting tool - RemoteMo...

09.04.2025 01:18 — 👍 7 🔁 2 💬 0 📌 0

GitHub - MythicAgents/Xenon: A Mythic agent for Windows written in C A Mythic agent for Windows written in C. Contribute to MythicAgents/Xenon development by creating an account on GitHub.

22.03.2025 00:16 — 👍 4 🔁 1 💬 0 📌 0

Red Teaming with ServiceNow - MDSec Introduction Over the course of numerous Red Team engagements MDSec has often gained privileged access to a target’s ServiceNow instance. This has, in turn, facilitated a variety of compromise actions...

21.03.2025 13:30 — 👍 1 🔁 1 💬 0 📌 0

Bypassing Windows Defender Application Control with Loki C2 Microsoft offers a bug bounty for qualifying bypasses into Windows Defender Application Control. Learn how IBM's X-Force team found a bypass using Loki C2.

19.03.2025 00:40 — 👍 2 🔁 1 💬 0 📌 0

AMSI Bypass: In-memory patching AMSI (Anti-Malware Scan Interface) was developed by Microsoft in 2015 to defend against fileless threats such as VBS, JavaScript, and…

16.03.2025 08:06 — 👍 1 🔁 0 💬 0 📌 0

Beyond the Hook: A Technical Deep Dive into Modern Phishing Methodologies A technical exploration of modern phishing tactics, from basic HTML pages to advanced MFA-bypassing techniques, with analysis of infrastructure setup and delivery methods used by phishers in 2025.

11.03.2025 20:00 — 👍 2 🔁 1 💬 0 📌 0

GitHub - dagowda/DSViper: This is for Ethical Use only! Update:- Currently the payloads can only bypass latest real time monitoring and not cloud based detections, due to a lot of virus total submissi... This is for Ethical Use only! Update:- Currently the payloads can only bypass latest real time monitoring and not cloud based detections, due to a lot of virus total submissions. Works like a charm...

10.03.2025 17:41 — 👍 0 🔁 0 💬 0 📌 0

GitHub - DarkSpaceSecurity/RunAs-Stealer: RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging - DarkSpaceSecurity/RunAs-Stealer

09.03.2025 20:19 — 👍 3 🔁 1 💬 0 📌 0

Using RDP without leaving traces: the MSTSC public mode Learn how MSTSC’s /public mode works! It blocks credential caching, session details, and bitmap storage, enhancing security. Discover its impact and how to reset MSTSC for a clean slate.

09.03.2025 19:11 — 👍 2 🔁 0 💬 0 📌 0

SoaPy: Stealthy enumeration of Active Directory environments through ADWS Due to modern defensive solutions, targeted and large-scale enumeration of Active Directory (AD) environments has become increasingly detected. Learn more on that and a new tool to help fight it.

23.02.2025 22:33 — 👍 5 🔁 3 💬 0 📌 0

@netbiosx is following 19 prominent accounts

James 🏴󠁧󠁢󠁷󠁬󠁳󠁿
@two06

Targeted Ops @TrustedSec. Hacker of things, writer of bad code. This is our world now... the world of the electron and the switch, the beauty of the baud. https://linktr.ee/two06

TrustedSec
@trustedsec.com

End-to-end Cybersecurity consulting team leading the industry, supporting organizations, and giving back. #HackThePlanet https://trustedsec.com/

Raphael Mudge
@raphaelmudge

Riding around in the breeze. Security Thinker. Hacker. USAF Veteran. https://aff-wg.org

@domchell

Scott Sutherland
@nullbind

SpecterOps
@specterops.io

Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management

Fragou Zoe
@fragouzoe

MITRE ATT&CK
@attack.mitre.org

MITRE ATT&CK® - A knowledge base for describing the behavior of adversaries. Replying/Following/Reposting ≠ endorsement.

Emeric Nasi
@emericnasi

CyberSecurity researcher and founder of BallisKit. I have a passion for all infosec subjects especially redteam and writing offensive tools!

💥 leonjza
@leonjza

[ 'cto @sensepost.com', '@orangecyberdef', 'caffeine fueled', '(╯°□°)╯︵ ┻━┻', 'security guy', 'metalhead', 'i saw your password', 'KOOBo+KXleKAv+KXlSnjgaM=' ]

0xdeadbeefJERKY
@0xdeadbeefjerky.com

Detection Engineer @ Meta Former Security Engineer @Lacework, Red Teamer @ Meta and security consultant

@redteamtactics

Outsmart, Outmaneuver, Redefine the Tactics blog 👉 https://posts.redteamtacticsacademy.com/ learn 👉 https://masterclass.redteamtacticsacademy.com

Antonlovesdnb
@antonlovesdnb

Hunt & Response @ Huntress Author of Constructing Defense 🇨🇦

_RastaMouse
@rastamouse.me

Wannabe security guy. Director @ Zero-Point Security.

Marc Smeets
@marcoverip

Does a thing or two with red teaming @ Outflank | part time race and drift car instructor

Cas van Cooten
@casvancooten.com

@chvancooten on the bird app 🐦 --- Benevolently malicious offensive security enthusiast || OffSec Developer & Malware Linguist || NimPlant & NimPackt author || @ABNAMRO Red Team

Scriptmonkey_
@scriptmonkey

Tester of Pens, Ex-Teamer of Red things, now with a more purpley shade. Biker and Recovering Eve-Online Addict. o7 https://blog.scriptmonkey.uk

DFIR Diva
@dfirdiva

DFIR Analyst Blog: https://dfirdiva.com/ Free & Affordable Training (DFIR, OSINT, Cybersecurity): https://training.dfirdiva.com/ Community Events: https://events.dfirdiva.com/ Curated List of Discounts: https://training.dfirdiva.com/current-discounts

Mr.Un1k0d3r
@mrun1k0d3r

Live hacking content https://truecyber.world/ Red team training https://mr.un1k0d3r.world/training/ Github https://github.com/Mr-Un1k0d3r