Security Researcher @Microsoft, opinions are my own.
Joined May 2022
- Tweets517
- Following605
- Followers783
- Likes1.4K
Pinned Tweet
What if you skipped VirtualAlloc, skipped WriteProcessMemory and still got code execution?
We explored process injection using nothing but thread context.
Full write-up + PoCs:
blog.fndsec.net/2025/05/16/t…
Yehuda Smirnov retweeted
CVE-2026-85844 is patched: a Windows Kerberos authentication bypass (CVSS 9.8).
Thanks @msftsecresponse for the fix!
Write-up in 2027, unless someone beats me to it and I can stay lazy.
msrc.microsoft.com/update-gu…
Yehuda Smirnov retweeted
Dumping Kerberos TGTs with Microsoft’s own signed binary 🔥
I added –klist & –klist-dump to NetExec’s SMB & WinRM protocols 🚀
No LSASS dump, no scheduled task as the interactive user. Just the built-in klist.exe.
Research: jakeotte.com/posts/klist-rev…
Yehuda Smirnov retweeted
🔎 What if you could run CodeQL on binaries as smoothly as on C/C++ code? We dug into CodeQL's internals to make it possible. Join our experts Raphaël and Maxime as they present BinQL, a CodeQL extension for querying binary formats at #GreHack26! cfp.grehack.fr/grehack-2026/…
Yehuda Smirnov retweeted
Slides and video for “Operationalizing Microsoft Defender for EDR Evasion” at AltSecCON 2026 are now available.
Explore the abuse of Microsoft's Boot-Time Removal driver (BTR.sys), common detection gaps, and approaches to operationalizing EDR evasion without traditional BYOVD abuse.
Slides:
16cdd728-52b5-4665-b161-3011…
Video:
youtu.be/fOgMByfU37A?si=_qCh…
#AltSecCON2026 #EDREvasion #RedTeam #AlteredSecurity
Yehuda Smirnov retweeted
Today @_rybaz and I are publicly releasing all the materials for our Introduction to Harness Engineering for Vulnerability Research training we gave at @unpromptedconf last week.
Our goal was to teach the concepts we've been using to do much deeper security research and make both vulnerability analysis and red team engagements far more impactful.
The workshop can be found here: grahamhelton.github.io/harne…
The slides can be found here: grahamhelton.com/talks/2026-…
Yehuda Smirnov retweeted
Bypassing SMB and LDAP signing with ntlmrelayx 🔥
I added both reauthentication bypasses to Impacket, now merged! Use –reauth-bypass on unpatched systems 🚀
LDAP can also start anonymously where accepted.
Research: blackfield.ch/blog/defeating… and specterops.io/blog/2026/10/2…
Yehuda Smirnov retweeted
Pass-ta-key Golden Attack: Extracting the Security Domain Secret from Chrome process memory
Blog:
0rcruxe.github.io/posts/pass…
POC:
github.com/0rcruxe/pass-ta-k…
Part 2:
0rcruxe.github.io/posts/pass…
Decrypting GPM Passkeys & Forging WebAuthn Assertions for Account Takeover
✍️: 0rcruxe
Yehuda Smirnov retweeted
Got this 2 days ago during a token replay attacks and... CAE policies bypass is working like a charm, no alerts nothing:
mitiga.io/blog/hunting-condi…
Then I had a look in the official documentation: such a gap in the coverage !
learn.microsoft.com/en-us/en…
In short, at this stage, we are faced with the following situation:
a blind SOC + policies that have been completely bypassed and no real solution until you increase your budget, ofc 👏
Yehuda Smirnov retweeted
Video of my @UnpromptedAU & Bsides Canberra talks out now
I built an autonomous N-Day exploit pipeline for the Windows kernel w/ mix of deterministic and AI-led stages. Results were comparable to what Anthropic achieved with Mythos using a much less powerful model.
Now online from BSides Canberra 2026: @chompie1337 presents “Building an Autonomous N-day Exploit Generation Pipeline”.
Watch now: youtu.be/03Xh_6_6U4M
Yehuda Smirnov retweeted
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.
projectzero.google/2026/10/f…
Yehuda Smirnov retweeted
Nice work - The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only! blog.orange.tw/posts/2026-10…
Yehuda Smirnov retweeted
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
Yehuda Smirnov retweeted
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
Yehuda Smirnov retweeted
A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.
Yehuda Smirnov retweeted
Been digging deep into the Windows Endpoint Security Platform (WESP) in Win11 25H2, definitely one of the most fascinating security features Microsoft has built in a while.
The concept is neat: compile rules to decision graphs in user mode, hand them to wesp.sys, and let the kernel evaluate them in-path while telemetry streams asynchronously in the background.
I did an AI-assisted reverse engineering dive into the whole stack (wesp.sys, espclient.dll, and wesp_elam.sys), documented the wire protocols, disposition tables, and the enforcement gate, and built esptool, a research harness with 118 XML rule docs so anyone can test live telemetry and in-kernel blocking.
Repo: github.com/marcosd4h/wesp_re…
Tech doc: github.com/marcosd4h/wesp-re…
Thanks to @yarden_shafir for putting this on my radar
Yehuda Smirnov retweeted
Exploiting AD ResetNightmare (CVE-2026-27912) and KerberLoss (CVE-2026-25177) from Linux - @rouge_cravate
cravaterouge.com/articles/re…
Yehuda Smirnov retweeted
My tweets haven't gone viral in a while now, so I must drop this banger: reburp
And yes, it's a game changer in applicative pentest and bug bounty. Following me was worth it.
Know how BurpSuite's API does not expose all that burpsuite can do in the UI? and how their MCP isn't better? it lets you read findings but can't do the workflows.
reburp is a small burp extension that uses the extension's access to the internal Montoya API object to re-expose it over a localhost OpenAPI REST API to bridge all that a burp extension can do, to your AI agents in seconds !
Your agent can now use burp's:
- active scan, stop/start scans, fuzzing, turbo intruder
- iterate entire sitemap tree
- websockets
- use tools like Generate CSRF PoC
- use other extensions e.g. Autorize
- Create custom Bambda rules and custom scanners
My favorite: you can explore burp features you haven't found in the UI even after 10 years using it
github.com/forefy/reburp
Yehuda Smirnov retweeted
Bypassing Android Hardware Attestation by Eric Le Guevel (@quarkslab)
blog.quarkslab.com/bypassing…
#infosec
Yehuda Smirnov retweeted
Tracking OAuth token exchanges is complicated. TATS can help.
@Icemoonhsv introduces the Token Analysis and Tracking System & shares some unexpected findings uncovered along the way.
Check it out! ⤵️ ghst.ly/4xMBaYd
