netbiosX

🚨 An AI attack for initial access, discovered by Forever Security recently: I tried to emulate the above scenario in the video: 1⃣ Malicious Markdown lands in Downloads 2⃣ Codex launched from the same directory 3⃣ Benign prompt submitted 4⃣ Hidden instructions processed 5⃣ calc.exe executed

🚨 Custom Extensions for SmartScreen Evasion 𝑫𝒆𝒕𝒆𝒄𝒕𝒊𝒐𝒏 𝑺𝒕𝒓𝒂𝒕𝒆𝒈𝒊𝒆𝒔 ✅️ Process Creation - Event ID 1 ✅️ Registry Key Creation of \Software\Classes - Event ID 12 ✅️ Registry Key Modification of \Software\Classes - Event ID 13 ✒️ ipurple.team/2026/10/22/c...

A new process injection technique has been disclosed to the public that places shellcode into a process via the SendMessageW API. 𝑺𝒐𝒎𝒆 𝒐𝒃𝒔𝒆𝒓𝒗𝒂𝒕𝒊𝒐𝒏𝒔: ⚠️ Extremely noisy from a debugger/telemetry perspective ⚠️ ~32 KB implant size limitation ⚠️ Abnormal Parent-Child process relationships

It looks like you can execute code by abusing .manifest files.

Playing with the newest process‑injection technique in my lab to explore defensive detection opportunities: Console Named Pipe.

🎙️ The dump encoding library (𝑾𝒆𝒓𝑬𝒏𝒄.𝒅𝒍𝒍) enables threat actors to adopt the encryption used by Microsoft in their implant. Dropping a short video: 1️⃣ Encryption of payload (calc.bin) using the Microsoft 𝑾𝒆𝒓𝑬𝒏𝒄.𝒅𝒍𝒍 library (part of Windows 10 and 11) 2️⃣ Decryption with a Private Key and Execution

🚨 Implant Encryption via the Microsoft Dump Encoding Library 𝑫𝒆𝒕𝒆𝒄𝒕𝒊𝒐𝒏 𝑺𝒕𝒓𝒂𝒕𝒆𝒈𝒊𝒆𝒔 ✅️ Image Load of WerEnc.dll by arbitrary Processes - Event ID 7 (Sysmon) ✅️ File Creation - Event ID 11 (Sysmon) ✅️ Network Connection - Event ID 3 (Sysmon) ✒️ ipurple.team/2026/09/21/d...

When I started ipurple.team two years ago, my goal was to give SOC teams practical detection opportunities across some of the most modern adversarial techniques. So far, I’ve documented 25 techniques, and every article includes: ✅ SIGMA Rules ✅ Sysmon Configs ✅ Threat Hunting Queries

Claude: Executing code by using a math calculation from a project session.

A Mythic C2 Profile that uses the Microsoft Graph API to communicate through a Microsoft Teams channel

Another day, another experiment playing with MCP and Codex to execute code.

There are two additional LOLBins capable of executing code that are part of the .NET ecosystem.

Disable Windows Defender via Antivirus Fake Registration

If you’re hunting for malicious .tt files (msbuild), follow the approach below to detect: ✅ 𝐏𝐫𝐨𝐜𝐞𝐬𝐬 𝐂𝐫𝐞𝐚𝐭𝐢𝐨𝐧: msbuild.exe ✅ 𝐌𝐨𝐝𝐮𝐥𝐞 𝐋𝐨𝐚𝐝𝐬: 𝑴𝒊𝒄𝒓𝒐𝒔𝒐𝒇𝒕.𝑽𝒊𝒔𝒖𝒂𝒍𝑺𝒕𝒖𝒅𝒊𝒐.𝑻𝒆𝒙𝒕𝑻𝒆𝒎𝒑𝒍𝒂𝒕𝒊𝒏𝒈*.𝒅𝒍𝒍 DLLs ✅ 𝐅𝐢𝐥𝐞 𝐂𝐫𝐞𝐚𝐭𝐢𝐨𝐧: T4 and output files under 📁 𝑪:\𝑼𝒔𝒆𝒓𝒔\<𝒖𝒔𝒆𝒓>𝑨𝒑𝒑𝑫𝒂𝒕𝒂\𝑳𝒐𝒄𝒂𝒍\𝑻𝒆𝒎𝒑\ ipurple.team/2026/08/24/t...

The iPurple Navigator has been updated to include the recent techniques: 🟣 Provisioning Packages ➡️ Execution 🟣 Mandatory User Profile ➡️ Persistence 🟣 Text Template ➡️ Execution Articles: ⤵️ 🔗 ipurple.team/2026/08/04/p... 🔗 ipurple.team/2026/08/11/m... 🔗 ipurple.team/2026/08/24/t...

🚨 It looks like text template files can be executed from msbuild.exe without any arguments.

A quick video of how to use MSBuild.exe to target a .csproj file that has been tampered with multiple text template files and execute code embedded in .tt files.

📢 Code Execution via Text Template Files 🎙️ T4 .tt files are intended for code and text generation. Threat actors can create or modify a .tt file to abuse legitimate developer tooling (LOLBins) to execute code in the context of a trusted process. ✒️ ipurple.team/2026/08/24/t...

Before AI, the path was: Technique ➡️ Blog ➡️ Community Reach ➡️ Career Growth ➡️ 💵💶 Now: Technique ➡️ Paid Course / Service ➡️ Direct Monetization 💵💶 The information still exists, it’s just no longer free. 💸💸

A security-research Proof-of-Concept (POC) demonstrating hardware-breakpoint (CPU debug register) based function hooking as an alternative to traditional in-memory code patching.

🚨 Code Injection via the 𝐌𝐞𝐬𝐬𝐚𝐠𝐞𝐁𝐨𝐱𝐈𝐧𝐝𝐢𝐫𝐞𝐜𝐭𝐖 API. 𝑷𝒓𝒐𝒄𝒆𝒔𝒔 🔴 Shellcode is stored in allocated process memory 🔴 The 𝒍𝒑𝒔𝒛𝑰𝒄𝒐𝒏 field ➡️ points to the shellcode address 🔴 The 𝒍𝒑𝒇𝒏𝑴𝒔𝒈𝑩𝒐𝒙𝑪𝒂𝒍𝒍𝒃𝒂𝒄𝒌 has the same address 🟰 lpszIcon address 🔴 Help event invokes 𝒍𝒑𝒇𝒏𝑴𝒔𝒈𝑩𝒐𝒙𝑪𝒂𝒍𝒍𝒃𝒂𝒄𝒌 ➡️ Shellcode Trigger

Persistence | Mandatory User Profile - Playbook & Detection Strategies

SquidC5 - Security-first AI-native C5 teamserver (Command · Control · Cognitive · Collaborative · Coordination)

Code Execution - Provisioning Packages

Shellph - a portable command-line utility designed to automate encryption and obfuscation of arbitrary shellcode

📝 Earlier this week, I wrote an article about how to abuse AMSI for persistence and detection guidance. You can find the visualization diagram below. 🔗 ipurple.team/2026/07/13/a...

🎙️ Threat actors with elevated permissions could register a fake AMSI provider to establish persistence. 𝑫𝒆𝒕𝒆𝒄𝒕𝒊𝒐𝒏 𝑺𝒕𝒓𝒂𝒕𝒆𝒈𝒊𝒆𝒔 ✅️ 7 - Sysmon Fake AMSI Provider DLL ✅️ 4663 - Modification of HKLM\SOFTWARE\Microsoft\AMSI\Providers Registry Key ✅️ 4688 - regsvr32 Process ✒️ ipurple.team/2026/07/13/a...

Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.

PhantomFS - a Windows honeypot that projects convincing decoy files, credentials, financials, SSH keys, into a virtual directory via ProjFS, then fires instant Event Log and Toast alerts the moment an attacker opens one.

P³-Shellcode Loader - a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.

Process Parameter Poisoning - an attack technique that is used to inject code on foreign processes, without triggering typical detection mechanisms.

A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation github.com/xec412/XeraLdr

Windows Service - Playbook & Detection Strategies ipurple.team/2026/07/06/w...

Hollow - a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside.

SpotifyC2 - a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery, without requiring the Spotify Web API.

Abusing GitLab CI Runners as a Command and Control Framework vrls.ws/posts/abusin...

NebulaPulsar - a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX), originally developed as part of the Alien project.

iPurple playbooks are now mapped to ATT&CK. The custom navigator has: 1️⃣ New Techniques with new ATT&CK IDs 2️⃣ Techniques and Sub-Techniques mapped to the iPurple playbook So if you are looking for a purple team playbook or detection guidance, visit the Navigator 🔗 navigator.ipurple.team

📢 QoS Policies - Restrict EDR agents Traffic from generating telemetry & Detection Strategies 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐒𝐭𝐫𝐚𝐭𝐞𝐠𝐲 - 𝐄𝐯𝐞𝐧𝐭 𝐈𝐃𝐬 ✅️️️ 5857 - CIM Provider ✅️️️ 4104 - PowerShell ScriptBlock ✅️️️ 4663 - Registry Key Modification ✅️️️ 4688 - Process Creation ✅️️️ qoswmi.dll 🖊️ ipurple.team/2026/06/17/q...