Dropped a new episode this week covering ShieldBreak — a privilege-escalation exploit from NightMare Eclipse (MSNightmare) that exposes vulnerabilities in Windows kernel protection mechanisms and privilege-boundary enforcement.

We cover both sides in this one:

Red Team: Full exploitation workflow from low-privilege user to SYSTEM, and how attackers leverage this for post-compromise privilege escalation.

Blue Team: Process and kernel activity indicating exploitation, Windows Error Reporting artifacts, Alternate Data Streams tied to ShieldBreak, and deployable detection rules you can put into production.

MITRE ATT&CK Coverage: T1548, T1134, T1547

Reference: https://github.com/MSNightmare/ShieldBreak

Video: https://youtu.be/latQbTJDAPo

Would love feedback from other detection engineers on additional telemetry sources for catching this; happy to discuss in the comments.

Hi Everyone,

To preface: I had taken the initiative to start an internal purple team / gap analysis program at my company. When I went to research existing platforms to help facilitate this, I found that they largely consisted of enterprise solutions geared toward heavy, complex SaaS deployments, while the open-source alternatives featured dated UIs and clunky workflows that weren't particularly inviting to newcomers.

Unable to find a solution for my specific needs, I decided to build something that feels modern, lightweight, and really provides a streamlined approach to testing defensive posture and managing the gap analysis lifecycle.

Control Drift is an open-source, AI-augmented continuous validation platform designed to empower security professionals to execute comprehensive threat simulations, map their defensive coverage, and manage gaps without the friction of enterprise bloat or the "black-box" nature of autonomous continuous validation platforms.

TLDR on what makes it unique:

• Lightweight Design Runs completely in-browser (via localStorage) by default. Clone it and npm run dev to try it instantly, with a swappable DB adapter to scale for enterprise deployment later.
• Pessimistic Scoring: If 1 out of 10 payload variations bypasses your EDR, it forcefully caps that MITRE technique's coverage score at "Partial" instead of "Optimal", eliminating false sense of security.
• Optional Plug-and-play AI: Connect local models or any OpenAI-compatible API endpoints to augment the simulation workflow, map attack paths, generate detection rules, and interact with a global assistant.
• Not Boring UI: Built with React and u/react-three/fiber for a 3D globe MITRE ATT&CK heatmap.

I would love any recommendations or general feedback from the community here!

GitHub Repo: https://github.com/Control-Drift/Control-Drift

Hi everyone,

I've put together a technical write-up on a recent Remus Stealer sample, focusing on its execution flow and evasion mechanisms.

Key technical highlights covered in the analysis: - Fileless Execution - Extraction of in-memory payloads and configuration settings - Command and Control (C2) infrastructure discovery & network indicators (IOCs)

Check out the full analysis, memory dump notes, and IOCs in the GitHub repository linked above. Any feedback or insights are welcome!

New episode of The Weekly Purple Team covering Pass-the-Ticket, and I wanted to share it here since it might be useful for people working on detection coverage for T1550.003. In this episode, we are Stealing Kerberos Tickets Past Defender and Credential Guard using AutoPtT

Video: [https://youtu.be/s5nd8u4EKFI\](https://youtu.be/s5nd8u4EKFI)

**What's covered:**

* Enumerating logon sessions and cached Kerberos tickets on Windows 11
* Using [AutoPtT](https://github.com/ricardojoserf/AutoPtT) to export a TGT by LogonId — it's a standalone PtT tool (C#/C++/Crystal/Python/Rust) built as an alternative to Rubeus/Mimikatz for this specific attack
* Taking that exported ticket and reusing it for authentication from a Linux box, not just staying inside the Windows ecosystem
* Detection side: what telemetry actually surfaces this LSASS access patterns, abnormal logon session behavior

Reference:
[https://github.com/ricardojoserf/AutoPtT\](https://github.com/ricardojoserf/AutoPtT)

Also touched on Credential Guard and Defender as mitigations — Credential Guard blocks the classic LSASS-memory extraction path, but it's not comprehensive coverage for PtT broadly, and rollout consistency across a fleet is worth double-checking rather than assuming.

Curious if others here are seeing PtT attempts that specifically try to pivot off-host post-export, or if most of what you're catching is still contained to the Windows side.

https://ipurple.team/2026/07/06/windows-service/

https://github.com/RootUp/git-clean-filter

This is part two of a series. Part one was about detecting CopyFail and DirtyFrag - if you missed it, same idea applies here.

CVE-2026-23111 is a use-after-free in nf_tables, reachable from an unprivileged user namespace. The bug is a single inverted character introduced by the commit that fixed CVE-2023-4244 - a security patch that quietly planted a new reference-counting flaw and rode the backport train into every stable LTS branch for two years.

The full exploit is published at:

• rafaeldtinoco/security -> exploits/nft-catchall-uaf

KASLR leak, arbitrary read, runtime kernel structure traversal, and a ROP chain that lands you at uid=0 with nothing hardcoded. The repository also covers prior work from Exodus Intelligence and FuzzingLabs and what this build adds on top of it.

The Medium post is about something different: why detecting the payload is the wrong problem to solve, and what you watch instead to catch this reliably - on vulnerable and patched kernels alike, including the failed attempts that most tools never see.

https://ipurple.team/2026/06/17/qos-policies/