Source Byte

I’m pleased to share the Patchwork CTI Framework v0.7.1, now publicly available for community review. Patchwork began as personal documentation, a way to connect the useful pieces of different CTI approaches. It has grown into a platform-independent framework for structuring observations, tracking adversaries, and sharing intelligence while preserving evidence, uncertainty, and assessment history. It brings together published approaches from CERT-EU, Mandiant/Google Threat Intelligence, Palo Alto Networks Unit 42, CISA, and OASIS STIX 2.1, documenting both what it adopts and where it deliberately differs. The framework covers: - Activity clusters, attribution tiers, and adversary naming. - Confidence, source grading, and provenance. - Classification, sharing rules, and STIX 2.1 serialization. - Report templates, worked examples, and documentation tools. A central design principle: stronger attribution should build on earlier assessments, not erase them. We’re also developing a compatible threat-intelligence platform. That work is ongoing, and adopting the framework does not require using our platform. This is a community-review draft, not a final standard. I’d welcome feedback from CTI analysts, researchers, CERT/CSIRT teams, and platform builders, especially on practical adoption, difficult attribution cases, and assumptions that deserve challenging. Explore the framework and join the discussion: https://github.com/CTI-Center/PatchWork #CTI

bullshit don't waste your time #T

My New Blog Post Evading Sysmon Dns Monitoring In 2026 | binary-win DNSevade : https://github.com/binary-win/DNSevade.git

Sysmon gets its DNS telemetry from the Microsoft-Windows-DNS-Client ETW provider. Let's hide in plain sight.

#sysmon #bypass Your Notes are HERE

We were able to identify 6 Iran related underground activity , but yet shared POC of "JumpJump" vpn incident is unknown to us. It will be very helpful to help us cluster this activity by sending more details in our channel DM :) also you don't need to pay for VPN !!! Unredacted group provide high quality free solutions to anyone who need free access to internet :) Try it now : https://unredacted.org/blog/2026/07/internet-freedom-is-here-freesocks-v2/

Building Something EDR-like with Rust×eBPF https://speakerdeck.com/sunlife3/rustxebpf-de-edr-ppoi-mono-o-tsukuru

Hi anyone an help me access t00ls.net ? appreciate your time :)

cool platform, don' miss it :)

Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF #CVE-2023-2156 (“Route of Death”) is a Linux kernel vulnerability that was believed to only lead to a DoS attack, and was considered patched in April 2023. However, Nebula Security discovered a bypass of the patch and found that it is actually exploitable and can lead to LPE on any Linux distribution that has IPv6 and namespaces enabled. This writeup covers the technical details of the exploit. https://nebusec.ai/research/cve-2026-43501-route-of-root/

You don’t always need to go for the hardest approach. Sometimes, you just need to understand what you actually need and choose the right path. As you know, LSASS is heavily monitored and protected nowadays, so getting a dump from it isn’t as straightforward as it used to be. So instead of getting stuck on LSASS and trying to bypass every protection around it, why not look at other options? If the goal is to obtain local account credential material, SAM might be enough for what we need. The point is simple: choose the technique based on the objective, not based on how complicated it is. #EDR #SentinelOne

i will waste my holiday on this 😂

🔓 Dumping NTLM Hashes from Windows Memory via forensics tools What can an attacker recover from a Windows memory image after gaining access to an endpoint?

In my new blog, I explored: WinPmem → Volatility 3 → SYSTEM/SAM → NTLM

#RedTeam #OffensiveSecurity

گروهی تخصصی برای متخصصین آفنسیو و ردتیم با زبان فارسی

اینجا قراره ریپورت‌هایی که منتشر میشه رو بررسی کنیم، تکنیک‌های جدید رو استخراج کنیم و درباره‌ی مشکلات فنی و چالش‌هایی که سر راه اجراست بحث کنیم.

https://t.me/+drFBtbbrVDo5NjA0

فارغ ازینکه sysmon قابلیت جمع اوری چه تلمتری هایی رو داره باید گفت سایتی که استفاده شده متاسفانه فاقد هرگونه دیتیل فنی هست و بیشتر جنبه تبلیغاتی داره به طور مثال پادویش در رتبه بهتری از trend micro و bitdefender و carbon black قرار داره 😕 https://www.edr-telemetry.com/scores