Research & Tradecraft

Research & Tradecraft

Part 6: What is a Procedure?

Sep 8, 2022 • 16 min read

Research & Tradecraft

Automating Azure Abuse Research — Part 2

Aug 31, 2022 • 8 min read

Research & Tradecraft

Part 5: Expanding the Operation Graph

Aug 18, 2022 • 17 min read

Research & Tradecraft

Part 4: Compound Functions

Aug 16, 2022 • 12 min read

Research & Tradecraft

Part 3: Expanding the Function Call Graph

Aug 9, 2022 • 15 min read

Research & Tradecraft

Part 2: Operations

Aug 4, 2022 • 10 min read

Research & Tradecraft

Encrypting Strings at Compile Time

Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and...

Jul 20, 2022 • 5 min read

Research & Tradecraft

Part 1: Discovering API Function Usage through Source Code Review

Jul 19, 2022 • 24 min read

Research & Tradecraft

Dealing with Failure: Failure Escalation Policy in CLR Hosts

Offensive tooling built upon the .NET framework and its runtime environment, the Common Language Runtime (CLR), is...

Jul 13, 2022 • 12 min read