Wietze's banner

Wietze

@Wietze • 7,541 subscribers

Threat Detection & Response. Views are my own, unless retweeted. Maintainer of https://t.co/000t7J0NBR & https://t.co/thv6PP5C48 Co-maintainer of https://t.co/rXIxOggXs2

Shorts

🔥 Recent additions to • applaunch.exe for applocker bypass • mscopilot/setupupc/dotnet-trace.exe for proxy execution • scp/ssh.exe for loading arbitrary DLLs • msoxmled.exe for downloading • fsutil.exe for preventing Windows Defender updates

🔥 Recent additions to • applaunch.exe for applocker bypass • mscopilot/setupupc/dotnet-trace.exe for proxy execution • scp/ssh.exe for loading arbitrary DLLs • msoxmled.exe for downloading • fsutil.exe for preventing Windows Defender updates

12,791 görüntüleme

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

Can LNK files ever be trusted? ⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself. 🐬

Can LNK files ever be trusted? ⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself. 🐬

145,489 görüntüleme • 8 ay önce

🚀 Today I'm launching ArgFuscator: an open-source platform documenting command-line obfuscation tricks AND letting you generate your own 🔥 68 executables supported out of the box - use right away, make tweaks, or create your own 👉 Now available at

🚀 Today I'm launching ArgFuscator: an open-source platform documenting command-line obfuscation tricks AND letting you generate your own 🔥 68 executables supported out of the box - use right away, make tweaks, or create your own 👉 Now available at

61,205 görüntüleme • 1 yıl önce

Yet another LNK flaw allows for target spoofing, yet executes any DLL, including remote ones via WebDAV. Even worse, unless you installed the Feb 2026 updates, MotW will be ignored. See how this works on

Yet another LNK flaw allows for target spoofing, yet executes any DLL, including remote ones via WebDAV. Even worse, unless you installed the Feb 2026 updates, MotW will be ignored. See how this works on

19,797 görüntüleme • 7 ay önce

#HuntingTipOfTheDay: folders with trailing spaces can be created on Windows, and they cause trouble: 🔴 Hard to delete/rename 🟠 Can hide files when same folder w/o trailing space exists 🟡 May enable UAC bypass(see next tweet) 🔍 Hunt for paths with trailing spaces - highly sus

#HuntingTipOfTheDay: folders with trailing spaces can be created on Windows, and they cause trouble: 🔴 Hard to delete/rename 🟠 Can hide files when same folder w/o trailing space exists 🟡 May enable UAC bypass(see next tweet) 🔍 Hunt for paths with trailing spaces - highly sus

11,433 görüntüleme • 1 yıl önce

Daha fazla içerik yok.