Loading story…
A technical write-up introduced PE-OopsSec, a toolkit from Two Seven One Three designed to identify operational security mistakes and metadata artifacts in Windows Portable Executable (PE) files that can expose malware, payloads, or developer environments. The article details how defenders and analysts can use indicators such as subsystem settings, debug symbols, Rich Header data, OriginalFilename mismatches, timestamps, resource language IDs, import tables, RTTI, import hashes, fuzzy hashes, and entropy to cluster binaries, support attribution, and flag suspicious files in EDR platforms and sandboxes.
The guidance frames PE metadata review as a pre-deployment checklist for red-team payloads and other Windows binaries, with mitigations including stripping debug information, using deterministic builds, disabling RTTI, dynamically resolving APIs, and reviewing hashes and entropy before release. A subsequent Reddit post amplified the article to the wider security community, positioning it as practical tradecraft for red teamers, malware reversers, and forensic practitioners rather than reporting a specific intrusion or malware campaign.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A technical article introduced the PE-OopsSec toolkit from Two Seven One Three for identifying operational security mistakes and metadata artifacts in Windows PE files. The piece outlined checks and mitigations involving debug symbols, Rich Header data, timestamps, imports, RTTI, hashes, entropy, and related artifacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**PE-sieve**, an open-source tool maintained by hasherezade, is being highlighted as a lightweight process scanner for detecting and dumping malicious code implanted in memory. The tool scans individual processes and identifies artifacts such as replaced or injected PE files, shellcode, hooks, and in-memory patches, with documented coverage for techniques including **Process Hollowing**, **Process Doppelgänging**, reflective DLL injection, and inline hooks. The project can be built as either an executable or DLL, exposes an API in DLL form, and relies on the **libPEConv** library for PE loading and manipulation; related projects include **HollowsHunter** for broader process or system scanning. Security researchers have also shown PE-sieve in practical malware-unpacking workflows. In one published walkthrough, analysts used it to recover an unpacked **AsyncRAT** payload injected into `aspnet_compiler.exe`, alongside alternative memory-dumping methods using Process Hacker and debugger-assisted inspection. The recovered implant required memory extraction and, in some cases, PE section-header realignment before tools such as dnSpy could parse the dumped .NET assembly, underscoring PE-sieve's role in incident response and reverse engineering of fileless or memory-resident malware.
Aug 14, 2026
Security research detailed a Windows code-injection technique that abuses Portable Executable (PE) sections marked readable, writable, executable, and shared (`RWX-S`) to place shellcode into another process without relying on common cross-process memory operations such as `WriteProcessMemory`. The method takes advantage of PE shared sections so that changes made in one process can be reflected in another process loading the same image in the same session, potentially reducing visibility to kernel-observed telemetry sources such as Microsoft-Windows-Threat-Intelligence ETW and `ObRegisterCallbacks`. The research said attackers could patch a host binary whose entry point resides inside an `RWX-S` section, causing shellcode to execute when the remote process loads the binary. Using VirusTotal Retrohunt and YARA to identify candidate files, the author found more than 10,000 unsigned matches overall, including 99 unsigned x64 samples, along with roughly 15 uniquely signed binaries with valid Authenticode signatures, only five of them x64. Microsoft PE format documentation provides the structural context for how such shared sections are defined, while the findings suggest these binaries are uncommon enough to give defenders a relatively high-fidelity detection opportunity despite their offensive value.
Aug 15, 2026
Multiple public research reports detailed how attackers can evade Windows security monitoring by abusing native APIs, loader behavior, and application logging. White Knight Labs and XPN documented techniques to suppress or bypass **Event Tracing for Windows (ETW)** visibility in .NET and Windows processes, while separate research showed that access-mask-based detections can be defeated with `DuplicateHandle` by first requesting only `PROCESS_DUP_HANDLE` and then cloning a more privileged handle to targets such as **LSASS** or **winlogon**. Microsoft documentation for `CreateProcessA` also appeared in the reference set because process creation remains central to many payload chains, including shellcode that ultimately launches command shells or follow-on tooling. Additional reports showed how attackers can blend execution into legitimate Windows behavior and trusted software. iPurple described **EntryPoint Hijacking**, in which a loaded DLL's entry point is overwritten so malicious code runs during normal thread creation or loader activity, reducing obvious injection signals and complicating EDR detection. NVISO separately analyzed Metasploit reverse-shell shellcode that walks the **PEB** and resolves APIs such as `LoadLibraryA`, networking functions, and `CreateProcessA`, while Hunt & Hackett showed that **ConnectWise Control/ScreenConnect** can be used for intrusion activity and that its own event logging can be disabled by patching `ScreenConnect.Core.dll`. Together, the reports underscore that defenders must validate loader integrity, monitor low-visibility handle requests and memory writes, and avoid relying on a single telemetry source such as ETW or application-generated event logs.
Aug 15, 2026