Jonny Johnson

No Agent, No Problem: Discovering Remote EDR As the reader, I’m sure you’re thinking — “oh great, another EDR internals or bypass post”. I can fully understand that sentiment, as…

Detailed write-up: jonny-johnson.medium.com/no-agent-no-...

GitHub project "JonMon-Lite": github.com/jonny-jhnson...

06.06.2025 13:00 — 👍 0    🔁 0    💬 0    📌 0

No Agent, No Problem: Discovering Remote EDR As the reader, I’m sure you’re thinking — “oh great, another EDR internals or bypass post”. I can fully understand that sentiment, as…

Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been working on for the past couple months.

This dives into DCOM Interfaces that enable remote ETW trace sessions without dropping an agent to disk.

(Write-up and project link below)

06.06.2025 13:00 — 👍 3    🔁 1    💬 1    📌 0

I am happy to announce JonMon2.0 has been published.

2.0 offers a lot of feature updates, as well as stability. More features still to come as time goes on. Enjoy and let me know if you have any issues or questions.

Link: github.com/jsecurity101...

28.01.2025 13:53 — 👍 0    🔁 0    💬 0    📌 0

New EtwInspector kinda going hard 👀

16.01.2025 14:07 — 👍 1    🔁 0    💬 0    📌 0

Windows 11 24H2 · Issue #1 · EvanMcBroom/perfect-loader Hi, will this work in windows 24H2?

The perfect loader library was updated this week to support changes made on Windows 11 24H2. A big thank you to Jarrod Davis (@tinybiggames.com) for reporting the issue and helping work on a solution!

A full writeup on the issues and fixes can be found here:
github.com/EvanMcBroom/...

08.01.2025 19:08 — 👍 6    🔁 2    💬 0    📌 0

Converted Matt Graeber's TraceLogging PS script into C# into the new EtwInspector.
gist.github.com/mattifestati...

Working quite well.

New EtwInspector coming soon...

07.01.2025 01:16 — 👍 4    🔁 1    💬 0    📌 0

My goal by the end of the year was to finish JonMon 2.0 and I am happy to say that I have done that....Now just to clean up the code, fix the wiki, and write a blog. Stay tuned :)

28.12.2024 22:54 — 👍 2    🔁 0    💬 0    📌 0

JonMon with the AMSI logs 👀

20.12.2024 03:59 — 👍 1    🔁 0    💬 0    📌 0

Oh this is sick I didn’t know this. Thanks for sharing!

13.12.2024 02:47 — 👍 0    🔁 0    💬 0    📌 0

Oh LETS GO

13.12.2024 02:46 — 👍 0    🔁 0    💬 0    📌 0

two boys are jumping in the air with the words lets gooooo !!! ALT: two boys are jumping in the air with the words lets gooooo !!!

04.12.2024 13:43 — 👍 1    🔁 0    💬 0    📌 0

Behind the Mask: Unpacking Impersonation Events Introduction

Microsoft's Threat-Intelligence ETW provider now supports events to identify token impersonation attacks. I wrote a blog on these events and how Microsoft is surfacing them:
jsecurity101.medium.com/behind-the-m...

04.12.2024 13:36 — 👍 9    🔁 2    💬 0    📌 1