>_
The Fuzz.
0xfuzz@thefuzz:~$ cat /etc/motd

It's always DNS.

Field notes from a defensive-security practitioner. Detection engineering, malware analysis, threat intel, and the occasional CTF writeup.

$ ls posts/$ filter --ctf
7
posts published
5
categories used
33
tags indexed
84
min total reading
featured

Pinned by the author

view all →
$ open --post chainsaw-a…
Tools & Scripts

Beyond 1102: detecting selective EVTX deletion in Chainsaw

Event ID 1102 catches the loud version of attacker log tampering. Selective deletion of individual records inside an EVTX, the technique DanderSpritz's eventlogedit module made famous, doesn't fire it. Walking through the gap, who exploits it, and the analyse gaps subcommand landing in Chainsaw.

Apr 27, 20269 min
$ open --post lumma-stea…
Malware Analysis

Pulling C2s out of a Lumma Stealer build, step by step

Walking one MalwareBazaar Lumma sample from password-protected zip to a deployable IOC list. Static-only path: 9 hardcoded .shop C2s, the Lumma 4.0 protocol surface, the Chrome 127 App-Bound Encryption bypass, and a YARA rule for the build family.

Apr 24, 202622 min
$ open --post ctf-ddc-hi…
CTF Writeups

DDC Regionals 2026 — Hidden Trouble 1

Hunting fileless WMI persistence on a dead-disk Windows 11 image. From ASEP-sweep through XOR'd C2 to the flag.

Apr 18, 202612 min
recent activity

Latest from the lab

Apr 28
Malware Analysis
Inside a 2026 ValleyRAT drop: Squirrel, Unity, Rust, and a 1-second password crack
Walking one Silver Fox sample from MalwareBazaar through every stage. Encrypted SFX, two signed-binary sideload hops, an 111 MB Rust loader with obfstr-style string XOR, a hardware-breakpoint VEH that finds 0F 05 opcodes for direct syscalls, and a custom-base64 carrier disguised as a Windows MUI.
20 min →
Apr 27
Tools & Scripts
Beyond 1102: detecting selective EVTX deletion in Chainsaw
Event ID 1102 catches the loud version of attacker log tampering. Selective deletion of individual records inside an EVTX, the technique DanderSpritz's eventlogedit module made famous, doesn't fire it. Walking through the gap, who exploits it, and the analyse gaps subcommand landing in Chainsaw.
9 min →
Apr 24
Malware Analysis
Pulling C2s out of a Lumma Stealer build, step by step
Walking one MalwareBazaar Lumma sample from password-protected zip to a deployable IOC list. Static-only path: 9 hardcoded .shop C2s, the Lumma 4.0 protocol surface, the Chrome 127 App-Bound Encryption bypass, and a YARA rule for the build family.
22 min →
Apr 18
CTF Writeups
DDC Regionals 2026 — Hidden Trouble 1
Hunting fileless WMI persistence on a dead-disk Windows 11 image. From ASEP-sweep through XOR'd C2 to the flag.
12 min →
Apr 17
Threat Intel
CVE-2026-33829: NTLM leak via the Snipping Tool deep link
A one-click NTLM coercion in the Windows Snipping Tool. The ms-screensketch URI handler accepts an unvalidated UNC path in filePath and opens it directly, leaking the user's Net-NTLMv2 response to any reachable SMB server. Walkthrough, working PoC, and detection.
9 min →
Apr 15
SOC
NTUSER.MAN persistence: HKCU writes without a registry API call
A persistence technique that loads keys into HKCU without ever calling a registry API. How the mechanism works, why it's a blind spot for callback-based EDR, and what to actually hunt for.
8 min →
$ cat all_posts.md