# \#windows
**URL:** https://taggartinstitute.org/tag/windows/34.md
[Latest](https://taggartinstitute.org/latest.md) · [Categories](https://taggartinstitute.org/categories.md) · [Tags](https://taggartinstitute.org/tags.md)
---
## [I guess Microsoft is Sherlocking Podman](https://taggartinstitute.org/t/i-guess-microsoft-is-sherlocking-podman/847)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [September 30, 2026, 1:11am UTC](https://taggartinstitute.org/t/i-guess-microsoft-is-sherlocking-podman/847 "2026-09-30T01:11:11Z")
It’s still going to be Hyper-V under the hood.
---
## [Text Template Abuse for Code Execution](https://taggartinstitute.org/t/text-template-abuse-for-code-execution/817)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [August 27, 2026, 12:54pm UTC](https://taggartinstitute.org/t/text-template-abuse-for-code-execution/817 "2026-08-27T12:54:51Z")
This one was new to me!
---
## [Winget can do DSC config now?!](https://taggartinstitute.org/t/winget-can-do-dsc-config-now/774)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [July 24, 2026, 4:38pm UTC](https://taggartinstitute.org/t/winget-can-do-dsc-config-now/774 "2026-07-24T16:38:22Z")
It can also run PowerShell scripts. This seems both useful and abuseful.
---
## [Register your own AMSI Provider](https://taggartinstitute.org/t/register-your-own-amsi-provider/757)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [July 13, 2026, 1:32pm UTC](https://taggartinstitute.org/t/register-your-own-amsi-provider/757 "2026-07-13T13:32:59Z")
Windows has example code now for implementing AMSI providers, and iPurpleTeam has a demo nefarious one.
---
## [Process Parameter Poisoning: A New Process Injection Technique](https://taggartinstitute.org/t/process-parameter-poisoning-a-new-process-injection-technique/752)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [July 10, 2026, 1:37pm UTC](https://taggartinstitute.org/t/process-parameter-poisoning-a-new-process-injection-technique/752 "2026-07-10T13:37:39Z")
Been a minute since a new one of these dropped.
---
## [General Tool Show and Tell](https://taggartinstitute.org/t/general-tool-show-and-tell/684)
**Author:** [@Brumbo](https://taggartinstitute.org/u/Brumbo)\
**Replies:** 1\
**Last updated:** [June 3, 2026, 5:04am UTC](https://taggartinstitute.org/t/general-tool-show-and-tell/684 "2026-06-03T05:04:02Z")
Similar to the Web Tools thread a little while ago, I was curious about any and all tools any of you all have come across lately. I was doing the HTB seasonal machine last night and was introduced to Penelope by a friend…
---
## [Identity after AD](https://taggartinstitute.org/t/identity-after-ad/683)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [June 2, 2026, 3:02pm UTC](https://taggartinstitute.org/t/identity-after-ad/683 "2026-06-02T15:02:42Z")
This is sort of based on an ongoing conversation at work, but I’m curious: what is everyone imagining identity looks like after Active Directory falls? It may not ever go away, but it’s already on life support. Entra is …
---
## [Edge stores passwords in cleartext](https://taggartinstitute.org/t/edge-stores-passwords-in-cleartext/617)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [May 5, 2026, 1:10pm UTC](https://taggartinstitute.org/t/edge-stores-passwords-in-cleartext/617 "2026-05-05T13:10:03Z")
Easy win for cred stealers.
---
## [wsl9x: Linux in the Windows 9x kernel](https://taggartinstitute.org/t/wsl9x-linux-in-the-windows-9x-kernel/596)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [April 22, 2026, 4:31pm UTC](https://taggartinstitute.org/t/wsl9x-linux-in-the-windows-9x-kernel/596 "2026-04-22T16:31:23Z")
This is glorious.
---
## [A few more protocol handlers :), Part 2 | Hexacorn](https://taggartinstitute.org/t/a-few-more-protocol-handlers-part-2-hexacorn/592)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [April 19, 2026, 12:05am UTC](https://taggartinstitute.org/t/a-few-more-protocol-handlers-part-2-hexacorn/592 "2026-04-19T00:05:33Z")
---
## [RedSun, yet another Defender 0-day](https://taggartinstitute.org/t/redsun-yet-another-defender-0-day/580)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [April 16, 2026, 3:42am UTC](https://taggartinstitute.org/t/redsun-yet-another-defender-0-day/580 "2026-04-16T03:42:25Z")
Just incredible work here from Redmond.
---
## [Microsoft rolls back some of its Copilot AI bloat on Windows | TechCrunch](https://taggartinstitute.org/t/microsoft-rolls-back-some-of-its-copilot-ai-bloat-on-windows-techcrunch/489)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [March 22, 2026, 3:09am UTC](https://taggartinstitute.org/t/microsoft-rolls-back-some-of-its-copilot-ai-bloat-on-windows-techcrunch/489 "2026-03-22T03:09:16Z")
I’ll take even the small Ws.
---
## [I think I finally have internalized Cypher](https://taggartinstitute.org/t/i-think-i-finally-have-internalized-cypher/444)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [March 13, 2026, 8:21pm UTC](https://taggartinstitute.org/t/i-think-i-finally-have-internalized-cypher/444 "2026-03-13T20:21:05Z")
I have written several custom Bloodhound queries at this point and now feel confident in my ability to really pivot through this data. AMA (about Cypher/Bloodhound).
---
## [Recall Busted](https://taggartinstitute.org/t/recall-busted/366)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 1\
**Last updated:** [March 12, 2026, 2:28am UTC](https://taggartinstitute.org/t/recall-busted/366 "2026-03-12T02:28:29Z")
Lol, lmao
---
## [Active Directory — Attack Architecture Map v1.1](https://taggartinstitute.org/t/active-directory-attack-architecture-map-v1-1/231)
**Author:** [@LeonVQZ](https://taggartinstitute.org/u/LeonVQZ)\
**Replies:** 5\
**Last updated:** [March 10, 2026, 3:42am UTC](https://taggartinstitute.org/t/active-directory-attack-architecture-map-v1-1/231 "2026-03-10T03:42:55Z")
Found this awesome resource, it is a great breakdown of AD mapping and attacks. I would add some more tools but it’s a great baseline.
---
## [Tool for deceptive LNK files](https://taggartinstitute.org/t/tool-for-deceptive-lnk-files/245)
**Author:** [@HGB](https://taggartinstitute.org/u/HGB)\
**Replies:** 1\
**Last updated:** [March 8, 2026, 4:30am UTC](https://taggartinstitute.org/t/tool-for-deceptive-lnk-files/245 "2026-03-08T04:30:09Z")
Wietze is back at it:
---
## [Windows 12 Reportedly Set for Release This Year as Modular, AI-first](https://taggartinstitute.org/t/windows-12-reportedly-set-for-release-this-year-as-modular-ai-first/230)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 4\
**Last updated:** [March 5, 2026, 12:39pm UTC](https://taggartinstitute.org/t/windows-12-reportedly-set-for-release-this-year-as-modular-ai-first/230 "2026-03-05T12:39:46Z")
Holy crap this sounds awful.
---
## [Windows Event 8004](https://taggartinstitute.org/t/windows-event-8004/203)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 5\
**Last updated:** [February 26, 2026, 2:38pm UTC](https://taggartinstitute.org/t/windows-event-8004/203 "2026-02-26T14:38:40Z")
How well do y’all know Windows Event 8004? This event is generated by Windows NTLM Auditing. It is useful for detecting NTLM brute-force attacks against non-DC endpoints. These logs have two shockingly useful fields: S…