Red/Purple Teamer | Blogger | Mod @ https://xitter.cf/t.co/f4RyUGl0zb | https://xitter.cf/t.co/nLrzzAcQw9

Internet
Joined January 2012
Panos Gkatziroulis 🦄 retweeted
Local Shellcode Execution via SetupIterateCabinetW New Medium post, today we are going to explore a shellcode execution technique that abuses SetupIterateCabinet (a Cabinet file enumeration function) to dispatch shellcode through a file callback pointer medium.com/@s12deff/local-sh…
4
15
372
Panos Gkatziroulis 🦄 retweeted
I wrote an article about the technique that was disclosed some years ago by @mrd0x - Custom Extensions, including detection opportunities. TL;DR: Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious file as a legitimate file or evade Windows SmartScreen. 🖊️ ipurple.team/2026/10/22/cust…
1
4
16
1,120
You can give me a follow if you're on the social media platform below. Link in the reply⤵️
1
1
527
Panos Gkatziroulis 🦄 retweeted
Grateful for the recent conversations we've had with @techspence and @alehurtadoxo youtu.be/INz5r8a1-6w?si=EnvL… xitter.cf/alehurtadoxo/status/21… Definitely give them a view and a subscribe. Lots more inbound friends
I had two of the founding fathers of detection engineering on Detection Dispatch to talk about what they've been farming with the community. 🌱 LOLDrivers. LOLRMM. LOLSkills. Catalogs that track legitimate tools and components that attackers abuse, giving us a shared place to build knowledge, hunt, and detection engineer the ways of prevention.....but the conversation went somewhere I didn't expect. I've spent so much of my career thinking about detection that this episode genuinely had me rewiring my brain around app control/prevention....Prevention isn't a replacement for detection. We need both, and I think we need to talk a lot more about how they work together. That's the episode, you don't want to miss. Thank you @M_haggis & @_josehelps for the laughs 🦉 🦉 🦉 🦉 Full episode dropping this weekend, subscribe to my Youtube channel to be notified 🔔
1
4
4
908
Panos Gkatziroulis 🦄 retweeted
Telling folks cyber is that serious and this week we saw why. 🥲 Sharing the panel with @OpenAI ✨
1
1
4
285
FYI, the invite expires in 3H ⤵️
There are updates in the iPurple Discord server today, with more planned later today. Whether you're on the red, purple, or blue team side, feel free to join us. ⏰ Invite Expires in 24H ➡️ discord.gg/XmJCvkbT
2
566
I wrote an article about the technique that was disclosed some years ago by @mrd0x - Custom Extensions, including detection opportunities. TL;DR: Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious file as a legitimate file or evade Windows SmartScreen. 🖊️ ipurple.team/2026/10/22/cust…
1
4
16
1,120
Panos Gkatziroulis 🦄 retweeted
While everybody is prompting for PHP, recently I ended up having to dump the LSA in a custom way. I have written a short article on the entire LSA decryption stack, with the C implémentation. 💫 Cross posted here blog.advens-c.tf/articles/ls… and here hideandsec.sh/books/windows-…
25
85
2,855
From Boot Key to Plaintext: How Windows LSA Secrets Are Deciphered from the Registry hideandsec.sh/books/windows-…
2
7
820
There are updates in the iPurple Discord server today, with more planned later today. Whether you're on the red, purple, or blue team side, feel free to join us. ⏰ Invite Expires in 24H ➡️ discord.gg/XmJCvkbT
1
4
1,228
Panos Gkatziroulis 🦄 retweeted
100% agree. Skilled humans with domain specific knowledge still need to ask the right questions, and evaluate answers - AI is an agent not an actor and cant generate its own intent or motivation. AI isnt replacing anyone with domain specific knowledge. Learning is still valuable.
1
1
4
392
A project that uses Confluence as a C2 🧐 github.com/dagowda/Confluenc…
2
12
54
2,914
I spent some time yesterday testing the PhantomBuffer technique released by @TwoSevenOneT. A few observations: ✅ Requires elevated privileges ✅ ~32 KB implant size limitation ✅ Stealthy from a common API monitoring perspective ⚠️ Noisy from a debugger/telemetry perspective due to process attachment Interesting technique nonetheless. Full video below - Calc version:
3
2
15
2,217
Panos Gkatziroulis 🦄 retweeted
New post: Writing a Beacon Object File from scratch in C. COFF internals, dynamic import resolution, and building a privilege enumeration BOF - no frameworks, no wrappers. Plus why execute-assembly lights up every EDR while BOFs barely register. by7e.dev/blog/bof-from-scrat…
15
54
2,065