PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Introducing Windows Notification Facility’s (WNF) Code Integrity

blog.trailofbits.com | blog | #windows | #reverse-engineering | #offensive-security | #defense | #kernel | #detection | #code-integrity | #wnf | #lsass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

WNF is an undocumented Windows notification mechanism spanning processes and kernel drivers; this post examines new code-integrity state names useful for security tools monitoring LSASS protections.
Published
Collected

Related coverage

blog · about.gitlab.com
Make every AI credit count: See, cap, and reduce agent spend
Costs for agentic development multiply with every task. Pick the right model, cut agent retries with GitLab Orbit, and control spend with real-time analytics.
blog · netspi.com
Common Red Team Techniques vs Blue Team Controls Infographic
Shares an infographic mapping common red team phishing attack workflows to blue team detective and preventative controls, plus practical stealth tips for both offensive operators and defenders.
blog · projectzero.google
Windows Drivers are True’ly Tricky
A bug in the TrueCrypt Windows driver, despite prior security audits, lets a normal user or low-integrity sandbox remap the main system drive and elevate privileges to SYSTEM or kernel.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
tool · github.com
Apple Private Cloud Compute (PCC) Security Source Code and Research Tools
Provides unprecedented source-level visibility into Apple's cloud AI infrastructure, allowing security researchers to verify cryptographic privacy guarantees and audit components eligible for Apple's PCC Security Bounty.
tool · github.com
KillerLand: Weaponized BYOVD Process Killer Collection Bypassing PPL & EDR Protections
Demonstrates how untrusted kernel IOCTL interfaces in signed OEM and vendor drivers continue to undermine Windows PPL security boundaries, enabling red teams to blind modern endpoint detection.
Back