ITSEC Newsletter 2026-02-05

Author

Henrik Falk
February 05, 2026

Digital Forensics: Registry Analysis for Beginners - Part 2 - System Information and Basic Persistence

In this second chapter of our beginner-friendly Windows Registry series, we are going to walk through the parts of the registry that reveal essential details about a system. This includes information about the operating system version, the active control set, the machine’s name, its time zone, the networks it interacted with, programs set to run automatically, services installed on the machine, and the system accounts stored in the SAM hive.

hackers-arise.com/digital-forensics-registry-analysis-for-beginners-part-2-system-information-and-basic-persistence

Kernel-Level Stealthy Observation of TTY Streams

I developed a kernel module to monitor tty connections (ie SSH Sessions, Terminal or Console sessions) in a stealthy way filtering only processes I am interested at. Instead of relying on direct system-call hooks, the approach comes from understanding how the kernel itself moves tty data and identifying a point in that path where observation can happen without drawing attention. This article walks through that understanding of the Linux TTY subsystem, and the research journey that led me to that design.

blog.cybervelia.com/p/kernel-level-stealthy-observation-of-tty-streams

Beyond ACLs: Mapping Windows Privilege Escalation Paths with

Windows Privileges are special rights that grant users the ability to perform sensitive, system-wide operations. In some specific cases, they can even completely override standard Access Control List (ACL) checks. This post will dive into the architecture of Windows access tokens and their associated privileges, we will also see how BloodHound can be leveraged to map these high-value privileges across an entire domain, revealing hidden pathways to privilege escalation.

www.synacktiv.com/en/publications/beyond-acls-mapping-windows-privilege-escalation-paths-with-bloodhound

Living off the Process

This is a technique that does as the name implies: We use what is already available to us in the remote process of our choosing to accomplish a given goal. In this case, the goal will be to write shellcode indirectly into the remote process with as low of a footprint as possible. When I say indirectly, I mean we won’t be using WriteProcessMemory to write the shellcode. That API does play a small role, but ultimately we will be indirectly writing our shellcode in 8 byte chunks using ROP gadgets and assembly stubs all made available in the remote process. We will also avoid the creation of RWX regions of memory.

g3tsyst3m.com/lotp/Living-off-the-Process