Malware & C2 Persistence Techniques on Windows: Run Keys to WMI
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Persistence
Malware & C2 
Linux Privesc Linux Persistence: systemd Timers, udev Rules, and PAM Modules
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Malware & C2 COM Hijacking for Persistence and Privilege Escalation
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Malware & C2 Abusing BITS Jobs for Download and Persistence
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Active Directory Group Managed Service Accounts (gMSA) and the KDS Root Key
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Tools & Defense Windows Registry Forensics for DFIR
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Active Directory Golden Ticket Attacks: Abusing krbtgt for Domain Persistence
How attackers forge Kerberos TGTs with the krbtgt hash to gain persistent domain dominance, and how blue teams detect and defend.
Security DLL Hijacking: Privilege Escalation and Persistence on Windows
How DLL search order hijacking and phantom DLLs lead to privilege escalation and persistence, plus Blue Team detection and defense.
Windows Privesc UAC Bypass Techniques: A Practical Overview of Auto-Elevation Abuse
A practical tour of Windows UAC bypass techniques abusing auto-elevating binaries, registry hijacks, and UACME, plus blue-team defenses.
Windows Privesc Abusing Scheduled Tasks for Windows Persistence and Privilege Escalation
How attackers abuse writable task XML, schtasks, and Task Scheduler to persist and escalate on Windows, plus blue-team detection.
Windows Privesc Abusing Registry Autoruns for Windows Persistence and Privilege Escalation
How attackers abuse writable Run keys and other autorun locations for persistence and privesc, plus how blue teams detect it.
Windows Privesc Lateral Movement and Persistence with WMI
How attackers abuse WMI for remote code execution and stealthy persistence, plus the detection and defenses blue teams need.
Linux Privesc Abusing systemd Services and Timers for Linux Privilege Escalation
How writable unit files, ExecStart hijacks, and timer abuse turn a foothold into root on systemd Linux hosts.
Linux Privesc Linux Persistence Techniques: Maintaining Access After Initial Compromise
A practical tour of Linux persistence: authorized_keys, cron, systemd, rc.local, and ld.so.preload, plus detection.
Tools & Defense Hunting Windows Persistence: From Autoruns to WMI Event Subscriptions
A practical guide to planting, detecting, and analyzing Windows persistence across registry, services, tasks, and WMI.