Security writeups, notes and research by jalster.https://jalster.org/https://jalster.org/posts/wsass/https://jalster.org/posts/wsass/No malware, no MiniDumpWriteDump. Just a signed WER binary from Windows 8.1 that Microsoft still trusts to write an unencrypted minidump of a PPL process.Sun, 27 Sep 2026 00:00:00 GMTred-teamwindows-internalscredentialsdefenderhttps://jalster.org/posts/ntdll-hooks-syscalls/https://jalster.org/posts/ntdll-hooks-syscalls/The difference between an EDR seeing an attack or missing it is often 5 bytes in memory. A walkthrough of user-land hooks, the classic bypasses, and why kernel callbacks make them insufficient today.Fri, 25 Sep 2026 00:00:00 GMTedrwindows-internalsred-teamblue-team