Carrying NCCDC Forward alexlevinson.wordpress.com/2026/07/28/c... A new home for NCCDC ncr.foundation/news/nccdc-n... The National Collegiate Cyber Defense Competition is moving to NCRF, a non-profit helmed by long-time event volunteers Alex Levinson & Dave Cowen. I trust both w/ this stewardship

Carrying NCCDC Forward

After 21 years of stewardship, UTSA and the Center for Infrastructure Assurance and Security are transitioning the National Collegiate Cyber Defense Competition to a new home. Dave Cowen and I are …

alexlevinson.wordpress.com

I wrote a little bit about COFF Mixing rastamouse.me/coff-mixing/

COFF mixing is kewl

bof2pico: Simple helper utility for converting BOFs into PICOs (with hardcoded arguments) that celebi knows how to understand. github.com/ofasgard/cel... Thanks to @rastamouse.me for the suggestion to include a format specifier with the arguments!

Hi, bluesky. I just created my account. And I wanted to share two of my most recent posts here about Crystal Palace and Mythic. fallenangel666-blog.pages.dev/posts/crysta... fallenangel666-blog.pages.dev/posts/mythic...

@raphaelmudge.bsky.social maybe of interest kerekesha.com/blog/pop-a-c...

"Some Magic Linker" - a tour of Crystal Palace and TCG. This video demos CPL's features and how they support time-of-use-composition. This enables modular tradecraft & capability recombination. This encourages use/color-agnostic tradecraft, separable from specific capability vimeo.com/1209887681

Some Magic Linker

A feature tour of Crystal Palace.

vimeo.com

Had a little play with user-defined intrinsics in Crystal Palace to POC a new intrinsic that I'd like to see get official adoption 🙏🏻 rastamouse.me/crystal-pala...

LSH delish aff-wg.org/2026/07/16/l... Another CPL and TCG update: Specify language-specific exception handlers in +unwind, user-defined intrinsics, and callnear to make before/after more useful.

LSH delish

Another Crystal Palace and Tradecraft Garden release is now available. This release fills some gaps from recent releases and rounds out the feature set (aka, stuff I wanted to ship, but didn’…

aff-wg.org

New post about a CET compatible stack spoofing technique and a loader integrating it :) bigbingus.com/posts/bingus... github.com/Sizeable-Bin...

BingusLdr: CET Compatible Stack Spoofing | bigbingus.com

BingusLdr: CET Compatible Stack Spoofing

bigbingus.com

Building red team curriculum from scratch is expensive. Get student-ready courses that use real red team tools with labs, assessments, and cert pathways included. Less overhead. More impact. #HigherEd #CyberPrograms #CobaltStrike

[BLOG] A quick look at Crystal Palace's hook chains and why you should consider them over single hooks for layering evasive tradecraft. rastamouse.me/cpl-hook-cha...

There's no constexpr in C, so the new __ror13_x intrinsic makes it easier to use hashes without the need for strings or pre-computed hashes. Useful when performing tasks like resolving syscalls. Just declare as a DWORD and use.

Raphael Mudge@raphaelmudge.bsky.social · last mo.

Cruising Forward with the Tradecraft Garden New update: * New cpl [verb] CLI interface * We have an install script! * More API hashing options aff-wg.org/2026/06/29/c...

Cruising Forward with the Tradecraft Garden New update: * New cpl [verb] CLI interface * We have an install script! * More API hashing options aff-wg.org/2026/06/29/c...

Cruising Forward with the Tradecraft Garden

A new Tradecraft Garden and Crystal Palace release is available. This release introduces a proper install script and consolidates its commands behind a cpl [verb] CLI interface. I’ve also added an …

aff-wg.org

The gap between “academic cyber labs” and real-world red teaming is shrinking. Students can now train with licensed Cobalt Strike and Zero Point Security’s Red Team Ops, built around real adversary emulation, not abstractions. This is how you teach modern offensive security.

I just wrote a new blog on bypassing CA policies in Entra ID that have a resource exclusion, and why you probably want to enable baseline enforcement if you have such policies. Enjoy! dirkjanm.io/bypassing-co...

I’m a selfie kinda guy now

MSF's Railgun was massively underrated but incredibly powerful. Resolve and call an API without needing to alloc and run a whole BOF or DLL. I hope to get this implemented nicely in CrystalC2 at some point.

Props to the team for getting this out now that they have to put up with me distracting them with stupid stories about ppl trying to sell me fish and what flavour Pringles I found.

Cobalt Strike@cobaltstrike.bsky.social · 2mo ago

Cobalt Strike 4.13 is live! Say "Hello World" to our Beacon Interpreter for native C scripting - plus an LLVM Beacon, smoother docking UX, sharper payload management and more. Read about all the new features in the release blog! https://ow.ly/bynP50Zaae4

A Long-running BOF Component Contract aff-wg.org/2026/06/10/a... An architecture and Crystal Palace best practice focused riff on Async PICOs and Custom Beacon Wakeups in Cobalt Strike by Marcos Gonzalez Hermida www.nccgroup.com/research/asy... Short LR-BOFs demo: vimeo.com/1200217753

Long-running BOFs Demo

An architectural POC for long-running BOFs.

vimeo.com

Cobalt Strike 4.13 is live! Say "Hello World" to our Beacon Interpreter for native C scripting - plus an LLVM Beacon, smoother docking UX, sharper payload management and more. Read about all the new features in the release blog! https://ow.ly/bynP50Zaae4

New blog post is up looking at what GEPA is, and how it can be used for refining prompts for security agents. This post was published as part of the @specterops.io GhostWorks initiative. Can't wait to show what we've been working on! specterops.io/blog/2026/06...

Prompt Engineering for Security Agents with GEPAPrompt Engineering for Security Agents: A Measurable Approach with GEPA

Stop hoping your prompt edits helped. GEPA uses Genetic-Pareto selection and scored evaluations to prove it. Real code, real results.

specterops.io

CS 4.13 is right around the corner, so I've been having a play with the new Beacon Interpreter. This script will stomp a PICO over a module, with unwind data, for post-ex.

Pushed 0.0.3 of my Crystal Palace VSC extension. It adds new +options, like +relax and +unwind; and adds better syntax support for the ised command.

More fun with Crystal Palace unwind data.

New Release: Havoc Professional 0.7 K-Noir 🐺 New Linux implant for x86_64 and AArch64, Stack Spoofing related improvments such as CET compliance and a function rule system, new registry manipulation extension and injection based capabilities. Link: www.infinitycurve.org/blog/k-noir

Havoc Professional 0.7: K-Noir

An introduction to Havoc Professional 0.7 K-Noir, featuring a new Linux implant for x86_64 and AArch64, CET compliant stack spoofing and rules systems, new Direct and P2P communication channels, new m...

infinitycurve.org

Cobalt Strike 4.13 has a new Aggressor hook to support BOF cocktails. Here's a quick walkthrough: rastamouse.me/bof-cocktail...

Interesting post by Marcos Gonzalez Hermida: Async PICOs and Custom Beacon Wakeups in Cobalt Strike. www.nccgroup.com/research/asy...

I had the occasion to play with EAF the other day, so I added a bypass to the TCG's PIC services module. It provides a way to resolve Win32 APIs through gadget in NTDLL's .text section.

Crystal Kit - Sliver - A sliver port of @rastamouse.me 's Crystal Kit by Simone Licitra: github.com/licitrasimon... Via: www.linkedin.com/posts/simone... (Cool to see Crystal Kit for CS, Xenon for Mythic, and now Sliver. Really really cool)

GitHub - licitrasimone/CrystalSliver: Crystal Palace Evasion kit for Sliver

Crystal Palace Evasion kit for Sliver. Contribute to licitrasimone/CrystalSliver development by creating an account on GitHub.

github.com