Henrik Falk August 06, 2026
Inside the Falcon How CrowdStrike Catches You
A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service (DNS / AMSI / browser / Identity Protection), and the cloud-loaded detection engine - plus every structural blind spot. How Falcon sees you, and where the seams are.
DbgMan
Provisioning Packages
Windows Provisioning Packages are used by Administrators to deploy configuration scripts on Windows environments by using a container format. Threat actors with elevated privileges could abuse provisioning packages to hide arbitrary payloads and commands within these containers. Furthermore, it could be used in conjunction with social engineering to deliver packages attached to emails targeting elevated users within organizations, or used established access to plant .ppkg files in network shares.
Purple Team
Abusing Extended Attributes to Bypass Application Control For Business
This post shows a practical bypass of Application Control for Business (formerly Windows Defender Application Control (WDAC)) by abusing NTFS Kernel Extended Attributes (Kernel EAs), which are treated as trustworthy.
Shells.Systems
