March 1, 2026
The Interception Layer: A Terrible Idea That Might Actually Work
A middleware architecture for intercepting, anonymizing, and logging all data between autonomous AI agents and frontier LLMs.
Blog
Technical articles and research write-ups. New posts publish here first, with older external writing linked below.
March 1, 2026
A middleware architecture for intercepting, anonymizing, and logging all data between autonomous AI agents and frontier LLMs.
February 28, 2026
AI agents with root access, no NDA, no background check, and no clue where your data ends up. Why autonomous pentest platforms are a compliance and security nightmare.
July 15, 2025
Part 2 of the MITRE ATT&CK agent series — prompt engineering techniques, chain-of-evidence validation, and fixing infinite loops.
July 15, 2025
Part 1 of building a MITRE ATT&CK mapping agent crew — architecture, RAG pipeline, and the first spectacular failures.
June 23, 2025
A downloadfix PoC using Service Workers to simulate failed downloads and trick users into running a "repair tool."
April 30, 2025
How well can GenAI deal with new trends? Building a minimalist C2 with dynamic LLM-assisted capability generation via MCP.
August 25, 2021
Combining DLL metadata cloning, export table copying, and fake code-signing into a single PowerShell workflow for DLL hijacking operations.
August 5, 2021
Emulating the Buer Loader threat using Rust for reconnaissance and a C# XLL dropper — from zero Rust experience to a working PoC.
June 16, 2021
Introducing LnkGen, a GUI tool for crafting malicious LNK shortcut files with bamboozle mode, alternate data streams, and expert options.
December 21, 2020
Exploring how reflection and AppDomain.AssemblyResolve can bypass Cobalt Strike's 1MB execute-assembly limit by loading .NET dependencies at runtime.
Archive
Published on NVISO Labs and other platforms.
SANS Blog
Recurring security issues observed over a decade of assessments — the problems that keep coming back.
Neuvik
Exploring how generative AI can be used to encode malware payloads and evade endpoint detection.
Neuvik
Technical case study on a privilege escalation finding involving a service that wouldn't start.
TrustedSec
In-depth guide covering modern NTLM relay attack techniques and mitigations.
NVISO Labs
Building a notification service to alert operators when new beacons check in on Cobalt Strike.
NVISO Labs
Introducing a tool for mapping out attack paths and visualizing offensive operations.
SCYTHE
Walkthrough on converting SCYTHE payloads into shellcode for use in custom loaders.
NVISO Labs
Techniques for spoofing parent process IDs to evade detection during offensive operations.
NVISO Labs
Using an unmanaged .NET file searcher to locate sensitive files during red team engagements.