Cobalt Strike Staging and Extracting Configuration Information

Tool-Less Extraction of IOCs from an Emotet Maldoc

Extracting the Cobalt Strike Config from a TEARDROP Loader

Shellcode Execution via EnumSystemLocalA

Manually Implementing Inline Function Hooking

Detecting Process Injection using Microsoft Detour Hooks

Detecting Parent Process Spoofing using KrabsETW

Chainsaw Tool - Search and Hunt Through Event Logs