Detection research, release notes, doctrine.
How a modern EDR sees, where its blind spots live, and how we study them — telemetry maps, our BYOVD driver research, surveys of common bypass techniques — plus annotated release notes each quarter and occasional design doctrine. Written to be useful to defenders too. We publish at category level; recipes and implementation detail stay in the licensed material.
The costume is not the accent.
The wire is the one place you can't encrypt your way to invisibility. Twenty-three C2 profiles, sealed sessions with rotating identity, edge fronting, per-serve payload mutation — what each layer buys, and why every layer wins its layer but none wins the layer above. With the wire ledger.
2026-10 · read 13Eight ways to survive a reboot, priced.
The persistence audit: the eight autostart locations we ship — registry pair to BITS — what each buys and costs under modern telemetry, why Run and RunOnce count as one row, per-host generation, and the Ghost family above the standard list. With the autostart hunt.
2026-10 · read 12How we would hunt ourselves.
Detection engineering against in-memory C2, from the other side. The conservation law of evidence; hunting memory by shape instead of bytes; why jitter loses to statistics; the named-pipe table everyone forgets — and the telemetry gaps we deliberately leave. With the concession ledger and the hunter's notebook.
2026-10 · read 11What each bypass still costs you.
Direct and indirect syscalls, unhooking, call-stack spoofing, sleep obfuscation, ETW tampering — the bypass shelf with meter readings. What each technique buys, what it still costs, how we run each in the C agent, and why single-trick implants age badly. With the price list.
2026-10 · read 10Mimikatz is a magnet. We use the library.
Every EDR on earth has a rule stack for the industry's loudest binary. The discovery module takes the other path: DCSync, Kerberoast, ADCS ESC1–14, shadow credentials — through a defender-grade .NET library, hosted in-process, scrubbed on exit. The recon-to-keys pipeline, with the telemetry it can't avoid.
2026-10 · read 09The shell that was never spawned
The managed answer to PowerShell's defense stack — flip two fields, host your own runspace — leaves four of six layers ringing. Phantom Shell answers all six: 116 builtins that create nothing, a lazy CLR runspace, return-clean AMSI/ETW stubs with a per-command lifetime, the policy cache nobody mentions, and a crash guard. With the stubs, side by side.
2026-10 · read 08What convicts an injector? Six baits, two controls, one answer.
A controlled bait series against SentinelOne + Defender on 24H2 — six injection patterns and two controls, one variable at a time, every row reproduced. The verdict inverts the folklore: it's not what your code does, it's where it lives. With the full board and the survivor's outline.
2026-10 · read 07The gauntlet: how a revision earns its ship
Undetectable is an adjective; we keep a method. Inside the evaluation lab: the tracked AV/EDR matrix, three lanes per engine family, the telemetry review, the regression loop when a lane fails — and the dead ends we preserve. With the ship rule and rev 0328's result.
2026-10 · read 06A way home, published on-chain
Ghost Chain, from the design side: why DGA and fast flux lose, what a recovery record on Polygon actually contains — an Ed25519-sealed, epoch-gated envelope — and the honest bill: public ciphertext, RPC dependence, wallet OPSEC. With the record structure and the recovery sequence.
2026-10 · read 05Rev 0328: receipts and a politer builder
The autumn release, annotated: Ghost Chain push confirmations you can actually see, a traffic profile per build with per-customer polymorphism, audit CSV export, a self-updating desktop client, and a fully bilingual panel. What shipped, and why it works the way it does.
2026-10 · read 04The 225 KB budget
Why the C agent is a small core that carries almost nothing — and how the on-demand module depot works: per-OS module pools, one-time fetch tokens, per-module keys, wipe on unload. With the full budget table and the fetch sequence.
2026-10 · read 03BYOVD, from the research side
Bring-your-own-vulnerable-driver is the loudest bypass technique of the decade. How the signed-driver trust model breaks, how we harvest, triage and rate candidates for our proprietary BYOVD capability — and the one policy that actually stops it. With the chain diagram and a candidate record.
2026-10 · read 02How an EDR sees you
A map of the modern detection stack — user-mode hooks, kernel callbacks, ETW, AMSI, and the correlation engine that is the real product. Where each layer is strong, where it quietly isn't, and what defenders should measure instead. With the stack diagram and an annotated event stream.
2026-10 · read 01The panel is the product
Why we built a browser-first C2 — and what we deleted to get there. The doctrine behind every decision on this site: the workstation as a credential, the honest console page, and the trade that browser-first forces on the wire.
2026-09 · readAnnouncements of new posts ship with the quarterly release notes.