41554 blogs · 4,417,066 posts Claim your blog

Record · corpus.blog/posts/01a08778-e061-7066-a991-c1022de7f181

Monitoring NTDLL for in memory patching

fluxsec.red · published 2 March 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at fluxsec.red Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 9
Words captured: 2,328

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/0xflux/Sanctum

github.com

https://github.com/Mr-Un1k0d3r/RedTeamCCode/blob/main/unhook_crowdstrike_64.c

github.com

EDR Evasion ETW patching in Rust Read at the source ↗

Reading Event Tracing for Windows Threat Intelligence Read at the source ↗

https://learn.microsoft.com/en-gb/windows/win32/api/winnt/ns-winnt-image_optional_header32?redirectedfrom=MSDN

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_section_header

learn.microsoft.com

https://doc.rust-lang.org/std/vec/struct.Vec.html

doc.rust-lang.org

https://github.com/0xflux/Sanctum/tree/main/malware

github.com

https://github.com/0xflux/Sanctum/

github.com