Offensive Developer && Red Teamer @ Outflank
The Netherlands
Joined January 2019
- Tweets432
- Following411
- Followers787
- Likes1.1K
Dima van de Wouw retweeted
Fifteen years ago, I co-founded MDSec. Today, that journey comes to an end.
In that time, we’ve written books, spoken at almost every major conference, and discovered and exploited more 0-days than I could count. We’ve hacked banks, $tock exchanges, tech giants, frontier AI orgs and all manner of companies in between. We’ve jackpotted ATMs, intercepted money from payment systems, compromised mainframes, beaconed mobile devices and got r00t more times than I can remember.
A huge thank you to everyone on the MDSec team and all the MDSec alumni, who helped make it such a wild ride. I’m immensely proud of what we built. And to all our customers, past and present, thank you for the trust and opportunities you gave us.
I’m excited for the next chapter. If the next 15 years are anything like the last, it’s time to strap in.
Dima van de Wouw retweeted
Microsoft wants EDR out of the Windows kernel. We checked the binaries
They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U
Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds.
What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues
Dima van de Wouw retweeted
New video: basic reversing of a Windows kernel driver.
WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port.
Full write-up: trainsec.net/library/malware…
Dima van de Wouw retweeted
Your MCP server works fine, but the agent can't find a tool, ignores your constraints, or misses key output. Why?
The client decides what the model sees. We dug into Codex and Claude Code to find out what they truncate, change, or drop entirely. ow.ly/h7L750ZTvaF
Dima van de Wouw retweeted
Guess what... @fortraofficial / @_ZeroPointSec are looking for a new content developer to join our ranks.
fortra.wd12.myworkdayjobs.co…
Dima van de Wouw retweeted
A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.
Dima van de Wouw retweeted
How do you run your own service inside Svchost.exe?
trainsec.net/library/malware…
Dima van de Wouw retweeted
Latest preview build (29661) ships wesp.sys! The long-awaited initiative that should make it easier for EDRs to move capabilities to user mode and stay more resilient against kernel-level attacks.
Dima van de Wouw retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
Dima van de Wouw retweeted
Had a blast working with my buddy @max__grim creating this badge! Thanks to @OutflankNL and @MDSecLabs for the conf. It was a blast again ❤️ Looking forward to the next one!
Dima van de Wouw retweeted
RedTreat #5 is a wrap, possibly the best one yet! Awesome talks, attendees and location ❤️ safe travels to all attendees from me, @MarcOverIP and @StanHacked
Dima van de Wouw retweeted
I just released the first public version of @BintracerLabs, a malware-analysis sandbox focused on macOS.
Bintracer can:
- Detonate Mach-O binaries, app bundles, and dylibs
- Extract DMG and PKG files
- Analyze JXA, AppleScript, Python, Perl, and shell scripts
This project is still early, but I can't wait to see what y'all think!
Dima van de Wouw retweeted
Ever wondered how an external developer can work with Outflank to get their tool into OST? We explore the process of incorporating infraRED, which can be used for auto deployment of RT infra (c2, redir, multi cloud, domains, email).Big thanks to @dsec_net! shorturl.at/VSd8a
Dima van de Wouw retweeted
New video: Process Memory Map in Code (Part 2).
MemMap now identifies the file behind a mapped or image block with GetMappedFileName. Turns out Windows hands that back as an NT path, not “DOS” path, so I build a conversion function.
Full write-up: trainsec.net/library/windows…
Dima van de Wouw retweeted
Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway.
New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks.
Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇
mrtiz.github.io/cet-callstac…
Dima van de Wouw retweeted
Wrote a blog post about abusing signed Google Chrome installers to achieve arbitrary code execution
blog.amberwolf.com/blog/2026…
Dima van de Wouw retweeted
Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations.
An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed.
research.checkpoint.com/2026…
Dima van de Wouw retweeted
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet.
Now you can. Enjoy!
netspi.com/blog/technical-bl…
Dima van de Wouw retweeted
I've been fairly quiet about recent events for good reasons, but this popped up on my radar - netspi.com/mdsec-security-al…
I don't have much to say except some companies will forever lack class. For anyone looking for a new pentest, red team or c2 product vendor, there are many great ones out there and do your homework - the ones I am personally familiar with and would wholeheartedly recommend are @AmberWolfSec, @remotethreat, @SpecterOps, @OutflankNL and @TrustedSec ❤️
Dima van de Wouw retweeted
New video: VMMap Basics.
128 terabytes of address space on 64-bit Windows, and almost none of it used. VMMap shows you what's actually committed and why: images, heaps, stacks, and more.
Full write-up: trainsec.net/library/windows…
