Chief Security Officer (CSO) || Security Researcher at ZeroSalarium.com || Penetration Tester || Red Teamer || Social Engineering Awareness Trainer
- Tweets 335
- Following 125
- Followers 5,600
- Likes 939
Pinned Tweet
Using SendMessage with WM_SETTEXT, we can perform stealth injection and bypass EDR, even with high-end Endpoint Detection and Response systems 🛡️
Github: TwoSevenOneT/PhantomBuffer
#CyberSecurityAwareness #Pentesting #redteam
ALT PhantomBuffer edr evasion run success with high end EDR monitor
ALT FindTargetWindows ultility in PhantomBuffer bypass edr tool kit
3
49
246
9,144
*#Cybersecurity #Interview tip*
A bonus question I often ask candidates during interviews:
If you're in a room with a laptop that has a #Windows locked screen, and you're the only one there, can you unlock it and get to the Desktop? If so, how would you do it?
I've received quite a few very creative answers 😁
ALT cybersecurity interview tip: question to unlock windows
25
9
147
36,497
Using SendMessage with WM_SETTEXT, we can perform stealth injection and bypass EDR, even with high-end Endpoint Detection and Response systems 🛡️
Github: TwoSevenOneT/PhantomBuffer
#CyberSecurityAwareness #Pentesting #redteam
ALT PhantomBuffer edr evasion run success with high end EDR monitor
ALT FindTargetWindows ultility in PhantomBuffer bypass edr tool kit
3
49
246
9,144
PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)
#redteam #Hacking #Pentesting
Detailed article:
zerosalarium.com/2026/10/Pha…
6
24
1,506
The Rusty guys at Microsoft are messing around with WinDbg 🙃
After stopping the debugging process, the DbgEng engine fails to release all objects, preventing a second dump file from being opened.
A golden rule: Always release what you allocate.
While building an automated analysis tool, I spent the whole day scratching my head over this bug in the latest WinDbg version 🤯
5
57
5,428
🥷 Now we can inject a payload into a remote process without using VirtualAllocEx and WriteProcessMemory.
No need to suspend the target process
New technique to evade EDRs:
Github: TwoSevenOneT/InjectSetConsole
#redteam #pentest #antimalware
10
189
997
59,999
InjectSetConsole performs process code injection by leveraging a Windows named pipe.
Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.
#securityblog #cybersecurity
zerosalarium.com/2026/09/edr…
1
12
80
7,736
PE‑OopsSec is a security utility designed to identify and flag common OPSEC mistakes hidden inside PE files
Like this: E:\Movies\Action\Not_Porn\I_Swear_Its_Not\Why_Would_I_Lie\You_Have_Trust_Issues\Told_You_So\Empty_Folder\NASA_hot_kitten.jpg.pdb
Github: TwoSevenOneT/PE-OopsSec
#redteam #antimalware #pentest
ALT PE-OopsSEC PECheck run demo
ALT PE-OopsSEC PEHash run demo
1
25
160
12,843
PE‑OopsSec automating the detection of sensitive leaks: hardcoded paths, debug artifacts, or metadata that could expose operational details.
Think of it as your safeguard against accidental disclosures
#securityblog #cybersecurity
zerosalarium.com/2026/07/pe-…
1
1
14
6,772
Been coding a lot with AI, so now I’m creating a toolkit (also AI‑assisted 😄) to check for OPSEC mistakes in PE files before they’re used in the real world.
Both the article and the toolkit will be released soon 🤗
ALT PE-OopsSec IAT check
ALT PE-OopsSec Imphash check
2
6
110
10,740
New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker
ALT EDRChoker run throttling EDR process list
ALT Elastic EDR blocked by EDRChoker
ALT EDRChoker run remove throttling EDR process
24
178
757
122,188
EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.
#itsecurity #securityblog #altimalware
zerosalarium.com/2026/06/edr…
1
26
109
20,015
Some powerful built-in Windows 11 programs are allowed to write files to Defender’s working directory:
\System32\msiexec.exe
\Register-CimProvider.exe
\svchost.exe
\lsass.exe
Tools and methods to find these whitelisted programs for other #antimalware
Github: /TwoSevenOneT/DefenderWrite
30
145
14,256
Challenge: Drop #mimikatz onto a drive with the latest Windows 11.
1. Found a way to write a file into Windows Defender’s working directory: Success ✅
2. Dropped "mimikatz.exe" into that folder: Failed 🛑
Conclusion: Windows Defender does not exclude its own executable folder
11
53
9,397
While I was trying to evade cloud-based EDRs, I accidentally found a way to temporarily block a client's machine network with a POC running as a Normal user.
Not using the Windows Filtering Platform (WFP) which requires Admin priv
I haven't thought of exploitation scenarios for this tool yet, it might be a dead-end #antimalware research direction 🤔
#redteam
3
31
162
17,140
To be honest, in many cases I test evasion or antivirus bypass by dropping #mimikatz onto the Desktop and running it to see if it works.
I don't use the EICAR test file 😂
Drop Mimikatz and the AV doesn't complain ==> something's worked
5
5
79
16,276
