Exploring remote EDR capabilities without traditional agents, the author demonstrates how to utilize Performance Logs and Alerts APIs for stealthy monitoring of security events on target systems. This method allows both offensive and defensive teams to enhance their visibility while avoiding the complexities of agent deployment.

Microsoft is testing its AI-powered Windows Recall feature, which allows users to take snapshots of their active windows for easier searching of content, with a rollout to Windows 11 Insiders. Concerns over privacy led to enhancements including opt-in functionality and security measures like Windows Hello authentication. The feature is designed to help users manage snapshots while ensuring sensitive information is filtered out.

Microsoft has identified a new malware, Lumma, which has been found on approximately 394,000 Windows PCs. The Lumma password stealer is designed to capture sensitive login information, raising significant security concerns for users. Microsoft is urging users to take precautions to protect their devices from this threat.

Microsoft's August 2025 Patch Tuesday addressed 107 vulnerabilities, including a critical zero-day in Windows Kerberos that could allow domain administrator privilege escalation. The update also fixed thirteen critical vulnerabilities, predominantly related to remote code execution and information disclosure, highlighting ongoing security challenges for Windows users.

The blog discusses PatchGuard, or Kernel Patch Protection (KPP), a critical security feature in Windows that protects the kernel from unauthorized modifications. It explains how PatchGuard operates asynchronously to monitor key kernel structures, triggers a blue screen of death (BSOD) upon detecting tampering, and delves into its initialization process and the challenges of reverse engineering it. Additionally, the article hints at potential bypasses for this security mechanism.

Hells Hollow introduces a novel technique for SSDT hooking, leveraging Alt Syscalls to bypass Microsoft’s PatchGuard protections on Windows 11. This method allows rootkits to intercept and manipulate system calls by modifying the KTRAP_FRAME, thus enabling a range of malicious activities while highlighting the vulnerabilities within the Windows kernel. Limitations of the technique are discussed, including its resistance to certain security measures like Hyper-V and HVCI.

SetupHijack is a security research tool designed to exploit vulnerabilities in Windows installer and update processes by hijacking file drops in writable directories. It allows attackers to replace legitimate files with malicious payloads, executing them with elevated privileges without needing admin access. The tool is intended for red team, penetration testing, and security research applications, emphasizing controlled and authorized use only.

ShadowCrypt is a project that enhances ransomware protection by camouflaging files with system-like extensions and hiding them in system directories, utilizing Windows shortcut files for easy access. It builds upon research from the paper "Hiding in the Crowd" and offers improved functionalities such as streamlined hiding processes, versatile recovery options, and integration with the right-click context menu for user convenience. The project aims to provide a cost-effective and user-friendly solution for secure file management on Windows systems.

The article discusses a recent research study that reveals vulnerabilities in Windows' Endpoint Privilege Management (EPM) system, which can be exploited by attackers to gain unauthorized access and escalate privileges. Researchers detail the methodologies used to uncover these security flaws and emphasize the need for improved protective measures within the Windows operating system.

NovaHypervisor is a defensive x64 Intel hypervisor designed to protect against kernel-based attacks by safeguarding memory structures and defense products on Windows 10 and later. Written in C++ and Assembly, it is in early development, not yet suitable for production, and includes instructions for setup, memory protection commands, and logging. Users must enable specific virtualization features to run the hypervisor effectively.

Bugfish Nuke is a Windows tool designed for emergency data deletion, allowing users to securely erase sensitive files and system traces with customizable overwrite options. It features an advanced function to lock out system access by corrupting Windows login files, and includes user-friendly elements like customizable audio notifications during the deletion process. Users are warned against misuse and encouraged to comply with legal guidelines while using the tool.

A critical flaw in the Windows version of WhatsApp has been discovered, allowing hackers to exploit the application and potentially sneak in malicious files. Users are advised to update their software immediately to protect against these vulnerabilities and safeguard their data.