- When MFA isn’t an option: The legacy of ROPC
- Better know a data source: Antimalware Scan Interface
- Better know a data source: Process command line
- Diary of a Detection Engineer: Babysitting child processes
- The why, what, and how of threat research
- Testing adversary technique variations with AtomicTestHarnesses
- What is it that Makes a Microsoft Executable a Microsoft Executable? An Attacker’s and a Defender’s Perspective
- Working With Sysmon Configurations Like a Pro Through Better Tooling
- Steering clear of bad drivers: How to apply Microsoft's recommended driver block rules
- Windows Defender Application Control (WDAC) Updates in 20H2 and Building a Simple, Secure Windows-only Policy
- Arbitrary, Unsigned Code Execution Vector in Microsoft.Workflow.Compiler.exe
- Application Whitelisting Bypass and Arbitrary Unsigned Code Execution Technique in winrm.vbs
- Threat Detection using Windows Defender Application Control (Device Guard) in Audit Mode
- Assessing the Effectiveness of Hash-based Application Whitelisting Blacklist Rules
- Adventures in Extremely Strict Device Guard Policy Configuration Part 1 — Device Drivers
- Bypassing Application Whitelisting with runscripthelper.exe
- Exploiting PowerShell Code Injection Vulnerabilities to Bypass Constrained Language Mode
- Bypassing Device Guard with .NET Assembly Compilation Methods
- Updating Device Guard Code Integrity Policies
- On the Effectiveness of Device Guard User Mode Code Integrity
- Device Guard Code Integrity Policy Auditing Methodology
- Windows Device Guard Code Integrity Policy Reference
- Using Device Guard to Mitigate Against Device Guard Bypasses
- Introduction to Windows Device Guard: Introduction and Configuration Strategy
- Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
- WMI Persistence using wmic.exe
- Does signed mean trusted? The Mimikatz dilemma
- Subverting X509Certificate.Equals in .NET
- Code Signing Certificate Cloning Attacks and Defenses
- Application of Authenticode Signatures to Unsigned Code
- Abusing PowerShell Desired State Configuration for Lateral Movement
- Writing Optimized Windows Shellcode in C
- Windows RT ARMv7-based Shellcode Development
- Windows File Confusion: Masquerading Unsigned Binaries as Signed Ones
- Security Descriptor Auditing Methodology: Investigating Event Log Security
- Antimalware Scan Interface Detection Optics Analysis Methodology: Identification and Analysis of AMSI for WMI
- Data Source Analysis and Dynamic Windows RE using WPP and TraceLogging
- Documenting and Attacking a Windows Defender Application Control Feature the Hard Way — A Case Study in Security Research Methodology
- mavinject.exe Functionality Deconstructed