Red Ghost Ops - Advanced Red Teaming & Evasion Research

SAM-EXFIL: Credential Extraction via Raw NTFS Volume Reads
As red teamers regularly operating against mature Windows environments, we frequently encounter endpoint detection and response solutions that monitor access to Windows credential hive files at the AP
May 8, 202610 min read
RexLDR | Anatomía de un Shellcode Loader Moderno: Técnicas, Evidencia y Perspectiva Dual
El 90% de los loaders mueren en los primeros 30 segundos Dato de contexto antes de entrar en materia: según la telemetría de Microsoft Cyber Signals 2025, más del 90% de los intentos de inyección de
Apr 12, 202618 min read
R
Red Ghost Ops - Advanced Red Teaming & Evasion Research
4 posts
Focused on modern evasion techniques, custom tooling, and bypassing enterprise defenses.
Windows Anti-Forensics: Erasing Tracks to Evade Blue Team in Red Team Ops
In red team engagements, persistence is only half the battle evasion is the other. A single overlooked log, cached DNS entry, or recoverable deleted file can unravel an entire operation. This post det
Nov 6, 20256 min read
Living in the Run Key: Practical Persistence for Red Team Ops
Boot or Logon Autostart Execution. Registry Run Keys / Startup Folder
Nov 6, 202516 min read