Grzegorz Tworek

Stopping a Windows service is not about killing its process. It would be too brutal, unexpected and above all – a bit problematic in the case of shared services, having one process hosting more than one service. Killing a process would terminate all services, which is not the goal in most

As you likely know, AppLocker examines EXE and DLL files to determine whether they are allowed to run based on the rules set by an administrator. For simplicity, let’s assume we’re dealing only with hash-based rules. This means that every time an EXE file is about to execute,

I rarely describe features and prefer to focus on my own research, undocumented corner cases, and other fancy things. And what if the feature is not widely known and interesting at the same time? Projected File System (or ProjFS) seems to meet these criteria. It is documented at https://learn.

This time, I will dig into undocumented Thread internals, focusing on a single bit present in KTHREAD structure. KTHREAD is a structure Microsoft mentions in many places (such as KeGetCurrentThread() documentation), but does not officially document, which sounds like a challenge. Fortunately, Microsoft's public symbols contain some information

Current network connections are one of the typical and most valuable volatile data. It’s clearly volatile as it disappears forever the moment you shut down your computer. Theoretically, you can log connections with Sysmon, but you need to do it in advance. If you have no such log, you