Field notes from
our operators
Tradecraft, tooling, and lessons we are willing to share. Written by the people who build and run our gear.
Turning Chrome Remote Desktop into Pure Red Team Ops
How to hide the Chrome Remote Desktop connection banner by patching a single dialog resource, then abuse host.json and MSI packaging to turn CRD into a quiet persistent access channel.
GDID: The Windows Global Device Identifier
Where the Windows Global Device Identifier lives, how Microsoft issues it, how it is used to track installs across services, and how far you can actually patch it.
Make Your Rust Implant More OPSEC
Stripping symbols, remapping paths, recompiling std with build-std, encrypting strings, and bypassing IsDebuggerPresent without ever touching the IAT.
DLL Sideloading and Proxying in Red Team Operations
Why we lean on third party signed binaries, how to hunt sideloadable DLLs with ProcMon and x64dbg, and how to build a Rust proxy DLL that runs your implant while the host app keeps working.