Tagged: Defensive Telemetry

November 23, 2025

LdrShuffle: Stealthy Code Execution via DLL EntryPoint Overwriting

LdrShuffle Stealthy code execution via modification of the EntryPoint of loaded modules at runtime. Summary Windows processses have various modules loaded at runtime. Each of theses modules has a DllMain() function defined, which will be invoked on process...

Open Source Tool

November 21, 2025

BitlockMove: New PoC for Covert Lateral Movement via BitLocker DCOM Hijacking

BitlockMove Lateral Movement via Bitlocker DCOM & COM Hijacking. This Proof of Concept (PoC) for Lateral Movement abuses the fact, that some COM Classes configured as INTERACTIVE USER will spawn a process in the context of...