XPN Infosec Blog

ID: 7f9a35c4-1981-51a8-ab4f-5f637473f9f8

STIX ID: identity--7f9a35c4-1981-51a8-ab4f-5f637473f9f8

Feed Type: rss

Earliest post: 2001-01-01

Latest post: 2026-07-30

Deeply technical offensive security and red-team research, covering post-exploitation, identity systems, Windows and macOS internals, credential access, malware development, and defence evasion.

Exclude posts that do not describe a security incident

Classification

Min Pub Date

01/01/2020

Max Pub Date

08/14/2026

Title	Date Published ↓	Describes Incident	Visible
Accelerating EDR Evasion with LLM-Driven Analysis	2026-07-30	True	True
The Accidental C2 - Exploring Dev Tunnels for Remote Access	2026-05-09	True	True
An Evening with Claude (Code)	2025-11-29	True	True
An Evening with Claude (Code)	2025-11-29	True	True
Administrator Protection Review	2025-06-20	True	True
Tokenization Confusion	2025-06-04	True	True
The SQL Server Crypto Detour	2025-04-16	True	True
ADFS - Living in the Legacy of DRS	2025-01-12	True	True
Identity Providers for RedTeamers	2024-03-18	True	True
MacOS "DirtyNIB" Vulnerability	2023-10-04	True	True
Okta for Red Teamers	2023-10-02	True	True
PNG Steganography from First Principles	2023-08-09	True	True
Restoring Dyld Memory Loading	2023-01-14	True	True
WAM BAM - Recovering Web Tokens From Office	2022-10-17	True	True
Exploring SCCM by Unobfuscating Network Access Accounts	2022-07-09	True	True
g_CiOptions in a Virtualized World	2022-05-15	True	True
NTLMquic	2022-04-11	True	True
Weird Ways to Run Unmanaged Code in .NET	2021-05-05	True	True
Azure Application Proxy C2	2021-04-24	True	True
Tailoring Cobalt Strike on Target	2021-02-04	True	True
Bring Your Own VM - Mac Edition	2020-12-28	True	True
We Need To Talk About MACL	2020-10-18	True	True
MacOS Injection via Third Party Frameworks	2020-09-23	True	True
Hiding your .NET - COMPlus_ETWEnabled	2020-06-06	True	True
Hiding your .NET - ETW	2020-03-17	True	True
AWS Lambda Redirector	2020-02-25	True	True