Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR

Abusing Cortex XDR Live Terminal as a C2

Analyzing and Breaking Defender for Endpoint's Cloud Communication

Attacking EDRs Part 4: Fuzzing Defender's Scanning and Emulation Engine (mpengine.dll)

Attacking EDRs Part 3: One Bug to Stop them all

Attacking EDRs Part 2: Driver Analysis Results

Attacking EDRs Part 1: Intro & Security Analysis of EDR Drivers