Offensive Developer && Red Teamer @ Outflank

The Netherlands
Joined January 2019
Dima van de Wouw retweeted
Microsoft wants EDR out of the Windows kernel. We checked the binaries They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds. What we found: • wesp.sys: a Microsoft-built file system mini-filter at altitude 329500 • EspFilterPort: the filter communication port it uses to reach user mode • espclient.dll: 120 Esp* exports for rules, filters and event queues
2
89
1
311
12,259
Dima van de Wouw retweeted
New video: basic reversing of a Windows kernel driver. WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port. Full write-up: trainsec.net/library/malware…
3
113
564
17,281
Dima van de Wouw retweeted
Your MCP server works fine, but the agent can't find a tool, ignores your constraints, or misses key output. Why? The client decides what the model sees. We dug into Codex and Claude Code to find out what they truncate, change, or drop entirely. ow.ly/h7L750ZTvaF
8
2
17
1,987
Dima van de Wouw retweeted
Guess what... @fortraofficial / @_ZeroPointSec are looking for a new content developer to join our ranks. fortra.wd12.myworkdayjobs.co…
1
11
39
5,690
Dima van de Wouw retweeted
A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.
2
78
2
458
27,438
Dima van de Wouw retweeted
How do you run your own service inside Svchost.exe? trainsec.net/library/malware…
3
42
263
14,462
Dima van de Wouw retweeted
Latest preview build (29661) ships wesp.sys! The long-awaited initiative that should make it easier for EDRs to move capabilities to user mode and stay more resilient against kernel-level attacks.
8
66
2
288
23,669
Dima van de Wouw retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈 Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses. 🌐 Browser-based cracking ⌨️ Cross-platform CLI with GPU/CPU support 💾 Searchable tables that fit on a 4 TB disk Read the blog: outflank.nl/blog/2026/09/08/…
7
160
6
450
34,503
Dima van de Wouw retweeted
Had a blast working with my buddy @max__grim creating this badge! Thanks to @OutflankNL and @MDSecLabs for the conf. It was a blast again ❤️ Looking forward to the next one!
1
4
30
1,095
Dima van de Wouw retweeted
Infosec tradecraft just became reusable by AI agents. SpecterOps just open-sourced: 79 skills. 22 reusable agents. 26 plugin families. BloodHound. Cobalt Strike. Outflank C2. Ghidra. Binary Ninja. Ghostwriter. Recon. AppSec. Code review. C2 development. Reverse engineering. Adversary simulation. Windows + macOS tradecraft. And this is NOT just for red teamers. Vulnerability researchers: These workflows could accelerate code review, patch analysis, 1-day research and potentially help with 0-day discovery when paired with real research expertise. Reverse engineers + malware analysts: Give agents structured workflows, references and tooling instead of starting every investigation from a blank prompt. Blue teams + detection engineers: Study the same offensive tradecraft, emulate attacker behavior, build better detections and start asking what telemetry survives increasingly agent-assisted operations. DFIR + threat intel: Understand what adversaries may automate next and turn repeatable investigative knowledge into reusable workflows. Red teamers: BloodHound attack paths, recon, C2 development, adversary simulation and operator tradecraft are becoming increasingly agent-assisted. This isn't another collection of AI prompts. It's practitioner knowledge being turned into reusable, reviewable security workflows. Potentially useful for everyone from CTF learners and newcomers all the way to malware analysts, reverse engineers, exploit devs, red teams, blue teams and vulnerability researchers. This is only the beginning. @SpecterOps Skills: github.com/SpecterOps/skills @OutflankNL and @kyleavery breakdown: outflank.nl/blog/2026/09/02/… #Infosec #RedTeam #ReverseEngineering
11
208
2
977
57,468
Dima van de Wouw retweeted
RedTreat #5 is a wrap, possibly the best one yet! Awesome talks, attendees and location ❤️ safe travels to all attendees from me, @MarcOverIP and @StanHacked
4
6
66
3,880
Dima van de Wouw retweeted
I just released the first public version of @BintracerLabs, a malware-analysis sandbox focused on macOS. Bintracer can: - Detonate Mach-O binaries, app bundles, and dylibs - Extract DMG and PKG files - Analyze JXA, AppleScript, Python, Perl, and shell scripts This project is still early, but I can't wait to see what y'all think!
10
24
102
6,605
Dima van de Wouw retweeted
Ever wondered how an external developer can work with Outflank to get their tool into OST? We explore the process of incorporating infraRED, which can be used for auto deployment of RT infra (c2, redir, multi cloud, domains, email).Big thanks to @dsec_net! shorturl.at/VSd8a
1
10
1,384
Dima van de Wouw retweeted
New video: Process Memory Map in Code (Part 2). MemMap now identifies the file behind a mapped or image block with GetMappedFileName. Turns out Windows hands that back as an NT path, not “DOS” path, so I build a conversion function. Full write-up: trainsec.net/library/windows…
33
1
155
12,506
Dima van de Wouw retweeted
Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway. New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks. Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇 mrtiz.github.io/cet-callstac…
1
27
1
88
5,347
Dima van de Wouw retweeted
Wrote a blog post about abusing signed Google Chrome installers to achieve arbitrary code execution blog.amberwolf.com/blog/2026…
2
64
2
223
12,630
Dima van de Wouw retweeted
Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations. An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed. research.checkpoint.com/2026…
6
165
11
680
146,485
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet. Now you can. Enjoy! netspi.com/blog/technical-bl…
15
197
11
754
67,959
Dima van de Wouw retweeted
I've been fairly quiet about recent events for good reasons, but this popped up on my radar - netspi.com/mdsec-security-al… I don't have much to say except some companies will forever lack class. For anyone looking for a new pentest, red team or c2 product vendor, there are many great ones out there and do your homework - the ones I am personally familiar with and would wholeheartedly recommend are @AmberWolfSec, @remotethreat, @SpecterOps, @OutflankNL and @TrustedSec ❤️
14
22
5
186
53,845
Dima van de Wouw retweeted
New video: VMMap Basics. 128 terabytes of address space on 64-bit Windows, and almost none of it used. VMMap shows you what's actually committed and why: images, heaps, stacks, and more. Full write-up: trainsec.net/library/windows…
1
39
1
215
9,368