Microsoft Office has a security feature called Protected View. This feature opens an Office document…
Microsoft’s Antimalware Scan Interface (AMSI) was introduced in Windows 10 as a standard…
PowerView is probably my favorite bit of code I’ve written, and definitely the one I most regularly use (as evidenced by my recent posts). My team also heavily utilizes the toolkit, and we’ve come up with some cool uses for it over the past several years. For a long…
Last September I wrote a post titled “Offensive Encrypted Data Storage” that detailed an approach to securely storing data on disk during offensive engagements. I recently revisited the idea a bit while once again thinking about disk artifacts…
