Job searching looks easy until you actually do it.
You open a pile of tabs, compare requirements with your experience, check whether the application link is real, then rewrite the same resume for the fifth time. It gets old fast.
I built a tool to handle the repetitive parts. This was my first serious taste of agentic development, and I wanted to understand the whole system, not just ask a model for a paragraph and hope for the best.
Analysis of a suspicious .NET loader recovered from a production server identified a multi-stage execution chain that decodes embedded Portable Executable (PE) payloads and uses native Windows APIs to perform process hollowing. The loader reconstructed configuration and payload data from reversed hexadecimal text, created a suspended .NET host process, mapped a replacement image into that process, changed the thread context to the replacement entry point, and resumed execution. The injected payload then launched a PowerShell reverse-shell command. Defensive controls stopped the outbound connection before the remote shell session was established. The attempted arbitrary code execution on a production system justified a High severity classification.
Hey, it’s been a while. Today we’re diving into a multi-stage post-compromise investigation that highlights an Initial Access Broker (IAB) handing off access to a buyer. This campaign involved layered C2 infrastructure, subtle persistence mechanisms, and anti-analysis tactics across multiple remote management tools.
The initial alert stemmed from an end-user seeing a visible error message. That single artifact pulled our team down a rabbit hole, eventually revealing a complex chain of initial entry, persistence staging, and access resale.
Welcome back to my blog today I’m going to be going over something I haven’t worked on since I was messing around on TryHackMe for my initial training with Atomic Red Team.
As of right now at my current position most of the team is comprised of standard helpdesk employees and I was hoping I could bridge the gap between security and helpdesk and hopefully get someone interested into security.
I wanted to start this off by saying I had never heard of mesh agent previously up until this point. Essentially it is an Open Source RMM tool with a 2010 style UI. It allows for capabilities that many other RMM tools offer which can be used for legitmate purposes aswell as malicious ones.
This post we’re going to go into the attack lifecycle of the attack some lessons learned and key points regarding the initial compromise.