Activity
Stars and mentions · Last 30 days, Oct 5 – Nov 3
Top repositories
TwoSevenOneT’s repositories ranked by pull request authors, as on trending.
Contributes to
Repositories outside TwoSevenOneT’s account where TwoSevenOneT opened or reviewed pull requests in the past 365 days.
Who noticed TwoSevenOneT
Everyone who starred or forked TwoSevenOneT’s repositories since the archive began in 2011.
Notable accounts
Ordered by the stars their own repositories have received.
Biggest fans
Accounts that starred the most of these repositories.
Breakout weeks
Each repository’s best week of new stars, with the release published around it.
Achievements
Awards earned by the repositories TwoSevenOneT owns. Select an award to embed its badge.
No awards yet
Repositories earn awards by reaching the top three in a completed trending day or week.
A repository earns an award for finishing first, second or third in a completed trending day or week, ranked by new stars, new forks or pull request authors. Awards follow a repository through renames and transfers and count toward its current owner. Weeks run Monday to Sunday, UTC.
Mentions
#Offensive_security #Malware_analysis PhantomBuffer: Effective EDR Evasion Through Stealth Injection zerosalarium.com ]-> TwoSevenOneT/PhantomBuffer ]-> cyberpocket.org // The article introduces "PhantomBuffer", a stealth technique that injects payloads into processes via SendMessageW with WM_SETTEXT, avoiding WriteProcessMemory, and leverages cdb.exe for thread hijacking, with recommendations to monitor related API calls and suspicious debugger activity
An EDR evasion technique that leverages SendMessage with WM_SETTEXT for stealthy injection, bypassing direct calls to WriteProcessMemory, a frequently monitored API in modern EDR products. TwoSevenOneT/PhantomBuffer
EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR TwoSevenOneT/PhantomBuffer
Launching payloads via a service recovery. RecoverIt crashes a broken Windows service so its recovery action launches a given payload. No Event ID 7045 fired. A tool by @TwoSevenOneT Tool: TwoSevenOneT/RecoverIt Post: hackers-arise.com #redteam #blueteam
InjectSetConsole: Proof of Concept for Process Code Injection Without Using WriteProcessMemory
InjectSetConsole: Proof of Concept for Process Code Injection Without Using WriteProcessMemory