@MathildeVenault

Security researcher at @CrowdStrike, living off cheese and adventures. Opinions are my own.

Joined November 2019
  • Tweets58
  • Following203
  • Followers345
2Media
Mathilde Venault retweeted
POC_Crew
@POC_CrewSep 23
#POC2026 👁️ Mathilde Venault(@MathildeVenault) - “Off the Path: the Treasure Hunt for New Process Injection Techniques”
6
1
28
3,123
Mathilde Venault retweeted
Yarden Shafir@yarden_shafirJul 27
Very quick blog post to start the week: "enhanced session" shares your host clipboard with virtual machines, even if you didn't copy/paste anything from the VM itself. Might be common knowledge but it surprised me so I'm sharing it here windows-internals.com/random…
5
43
2
170
16,135
Mathilde Venault retweeted
Kyle Cucci@d4rksystem5 Jun 2025
I often am asked for pointers on building a VM for malware analysis. I wrote a 40+ page chapter on this in my book Evasive Malware. You can download this chapter from the book on my blog for free here: evasivemalware.com/EvasiveMa… Thanks @nostarch for allowing me to give it away 🤓
2
53
2
255
16,479
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir29 May 2025
Looks like @BlueHatIL talks are online now, so here’s my talk for anyone who wanted to learn about the latest episode of KASLR and couldn’t make it: youtu.be/Dk2rLO2LC6I

BlueHat IL 2025 - Yarden Shafir - Look, Ma—No Privileges! How Windows...

Look, Ma—No Privileges! How Windows Gives You Kernel Pointers (Even...

youtube.com
10
83
301
48,194
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir9 May 2025
FYI if you’re willing to link with ntdll or dynamically resolve it there’s a ton of APIs that return TEB/PEB or leave them in one of the registers. (Don’t believe official return values. MSDN is a liar!)
vx-underground
@vxunderground7 May 2025
Daax, being the traditional memesteroni he is, shared a cool proof-of-concept which demonstrates how to get a pointer to the Process Environment Block without using the GS and/or FS register. Look at the full thread. It's interesting.
3
36
1
271
29,906
WinDbg doesn’t have to win the battle!🧠💥 Join @MathildeVenault at SINCON 2025 for a hands-on reverse engineering workshop that helps you make sense of the Windows debugger. 📅22-23 May 2025 | 📍voco Orchard, SG 🎟️Pass: event.cybersecuritysg.com/39… #SINCON2025 #WindowsDebugging
2
1
263
Mathilde Venault retweeted
clearseclabs@clearseclabs17 Apr 2025
Upcoming public training: clearseclabs.com/#portfolio
1
1
201
Mathilde Venault retweeted
Mari0n@pinkflawd26 Mar 2025
Save the date - @Blackhoodie_RE is partnering with @offensive_con this year to bring a BlackHoodie training to Berlin! Students will learn how to place compiler backdoors in innocent code. Mark your calendars for May 15th! Registration opens tomorrow, space is very limited ☺️
13
1
24
12,245
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir5 Mar 2025
I’m not saying you definitely have to go to @BlueHatIL this year, I’m just letting you know it’s free, by the beach and I’ll be there dropping kernel pointers to anyone who asks nicely
3
22
105
15,803
#CVE-2025-21419 2025-Feb Windows Setup Files Cleanup Windows Setup Files Cleanup Elevation of Privilege #ghidriff uncovering arbitrary delete vulnerabilities 👀 🔍 Patch introduced new function DeleteFileEx_MSRC. Not your typical function name... 🧐 A patch diffing 🧵...
2
10
26
2,771
Mathilde Venault retweeted
Connor McGarr@33y0re3 Feb 2025
Today I’m sharing a blog post on the implementation of kernel mode shadow stacks on Windows! This post covers actively debugging the Secure Kernel and also outlines why VTL 1 is relied on to help maintain the integrity of the supervisor shadow stacks! connormcgarr.github.io/km-sh…

Exploit Development: Investigating Kernel Mode Shadow Stacks on Windows

Using SourcePoint’s JTAG debugger to investigate the implementation of Intel CET Shadow Stacks in kernel-mode on Windows

connormcgarr.github.io
10
151
6
490
53,073
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir14 Sep 2024
There’s a brand new conference which means you get another chance to take my Windows Internals class, this time in the US 😄 RE//verse, February 2025, Orlando Florida
RE//verse
@REverseConf13 Sep 2024
Replying to @REverseConf @securelyfitz @naehrdine @ElykDeer @palleiko @mr_phrazer
Uncover how GRU bootkits and PLA supply chain implants work in Yarden Shafir’s @yarden_shafir Windows Internals course. re-verse.io/windows-24/

RE//verse Training - Windows Internals for Security Engineers with Yarden Shafir

Covering Windows 11 “23H2”, the upcoming “24H2”, and Server 2022 and 2025, you'll unravel the secrets of how GRU bootkits, PLA software supply chain implants, NSA backdoors, and other kernel and...

re-verse.io
14
1
54
16,522
Mathilde Venault retweeted
hasherezade
@hasherezade25 Jul 2024
In my new blog for @_CPResearch_ I propose a new injection technique, using the Thread Name API - check it out! 💙
Check Point Research
@_CPResearch_25 Jul 2024
In this blog we introduce Thread-Name Calling - A new process injection technique using Thread Name. We also discuss various scenarios in which this not widely-known API can be used for offense. research.checkpoint.com/2024…

Thread Name-Calling - using Thread Name for offense - Check Point Research

Research by: hasherezade Highlights: Introduction Process injection is one of the important techniques used by attackers. We can find its variants implemented in almost every malware. It serves...

research.checkpoint.com
19
165
6
631
93,656
Mathilde Venault retweeted
gaut
@0xgaut11 Jun 2024
look what they took from us
4,024
74,891
8,956
838,626
44,550,447
Mathilde Venault retweeted
Connor McGarr@33y0re3 Jun 2024
Recently I was writing up a blog about Secure Kernel and NT working together to initialize Kernel CFG. I realized there were a lot of concepts in SK I was unfamiliar with. Because of this I wrote a post on one of those topics - Secure Image Objects. Enjoy! connormcgarr.github.io/secur…
10
100
1
277
29,850
Mathilde Venault retweeted
Bill Demirkapi
@BillDemirkapi14 May 2024
Thanks to everyone who attended my talk! @offensive_con was an incredible experience. Couldn't make it? Don't worry- here are my slides! Recommend them to anyone wanting to learn more about Secure Boot's third-party risks. nbviewer.org/github/microsof…
Bill Demirkapi
@BillDemirkapi9 Apr 2024
Ecstatic to share that my talk was accepted to Offensive Con. Excited to have an excuse to visit the city I was born in. Hope to see you there!
3
15
71
28,291
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir27 Mar 2024
Anyone who uses WinDbg a lot should learn to use Symbol Builder (by @wmessmer). Using it here to define a function signature and combining it with FileSystem module to write log all IOCTL requests to a file.
2
19
3
136
27,027
Mathilde Venault retweeted
Yarden Shafir@yarden_shafir30 Jan 2024
Good morning! Here's a short post about the things I found when my computer started repeatedly crashing. Didn't fully fix the problem but discovered some fun things on the way: windows-internals.com/troubl…
13
38
2
173
29,823
Mathilde Venault retweeted
Alice Climent@AliceCliment14 Jan 2024
Stolen from @bot59751939
2
9
859
Mathilde Venault retweeted
Connor McGarr@33y0re5 Dec 2023
It was a few weeks ago now but I wanted to sincerely thank @Steph3nSims for inviting and allowing me to speak at SANS Hackfest in LA! I am also so happy to report I finally meet @chompie1337 as well as @FuzzySec! I posted my slides if anyone cares! 🔗: github.com/connormcgarr/Pres… !
4
32
3
123
30,454
Load more