56,966 blogs · [ { "id": "01a0875d-e18e-7062-82c3-5043622baed1", "title": "Following an access token with WinDbg: what Windows sees when you ask for access", "url": "https://www.chadduffey.com/windows/windbg/security/2026/05/04/FollowingAnAccessTokenInWinDbg.html", "published_at": "2026-05-04T02:00:00+00:00" }, { "id": "01a0875d-e18e-7062-82c3-504362dc3a58", "title": "Why admin still can't touch some Windows processes", "url": "https://www.chadduffey.com/windows/security/2026/04/26/WhyAdminStillCantTouchSomeWindowsProcesses.html", "published_at": "2026-04-26T22:00:00+00:00" }, { "id": "01a0875d-e18e-7062-82c3-5043635c7010", "title": "Before main(): tracing what Windows really does when you call CreateProcess", "url": "https://www.chadduffey.com/windows/windbg/2026/04/20/BeforeMainCreateProcess.html", "published_at": "2026-04-20T10:00:00+00:00" }, { "id": "01a0875d-e18e-7062-82c3-504363727865", "title": "Moving SYSVOL to a new disk", "url": "https://www.chadduffey.com/windows/2024/04/19/MovingSysvol.html", "published_at": "2024-04-19T14:24:25+00:00" }, { "id": "01a0875d-e18e-7062-82c3-504363ce638c", "title": "Using IL NOPs with dnSpy", "url": "https://www.chadduffey.com/windows/2023/10/31/IL-NOP-DNSpy.html", "published_at": "2023-10-31T14:34:25+00:00" }, { "id": "01a0875d-e18e-7062-82c3-504364895d95", "title": "Converting ETL to EVTX in 'real time' (for Azure App Proxy Front End Logs)", "url": "https://www.chadduffey.com/windows/2023/09/01/ETLtoEVTX.html", "published_at": "2023-09-01T14:34:25+00:00" }, { "id": "01a0875d-e18e-7062-82c3-504365718485", "title": "WordPress Backdoor", "url": "https://www.chadduffey.com/wordpress/malware/2022/12/15/WordpressMalware-copy.html", "published_at": "2022-12-15T14:34:25+00:00" }, { "id": "01a0875d-e18e-7062-82c3-5043663076a0", "title": "HTB: Search", "url": "https://www.chadduffey.com/hack_the_box/active_directory/2022/12/15/Search.html", "published_at": "2022-12-15T14:34:25+00:00" }, { "id": "01a0875d-e18e-7062-82c3-504366fbc9d9", "title": "Using Microsoft CES/CEP for Linux Workstation Certificate Enrollment with Kerberos Workstation Authentication", "url": "https://www.chadduffey.com/active_directory/certificate_services/2022/11/01/CESCEP.html", "published_at": "2022-11-01T14:34:25+00:00" }, { "id": "01a0875d-e18e-7062-82c3-50436781c78f", "title": "Shadow Credentials", "url": "https://www.chadduffey.com/active_directory/red_team/2022/10/30/ShadowCreds.html", "published_at": "2022-10-30T14:34:25+00:00" } ] posts Claim your blog

Blog · corpus.blog/blogs/chadduffey.com/posts