# ghost hunting (blogs) — RSS Amplifier Recent posts from the 2 feeds in the RSS Amplifier directory that cover ghost hunting. Page: Feed: --- ## [Reverse engineering what HyperGuard monitors in ntoskrnl](https://fluxsec.red/what-does-hyperguard-skpg-monitor-vtl1-windows-internals-secure-kernel-patch-guard) _2026-07-26 · Fluxsec.red Blog_ ## [A Box Full of Darkness](https://thehauntedlibrarian.com/2026/03/14/a-box-full-of-darkness/) _2026-03-14 · The Haunted Librarian · (untitled)_ St. James’ recent offering is a moody, multi-narrator paranormal mystery set in 1989, a year where the antics could possibly occur. I was left with one unanswered question and hope to get feedback when my book club discusses. Recommend reading. ## [Crimes against NTDLL - Implementing Early Cascade Injection](https://fluxsec.red/implementing-early-cascade-injection-rust) _2026-03-14 · Fluxsec.red Blog_ ## [Stitched Grief: A Brief History of Mourning Embroidery](https://thehauntedlibrarian.com/2026/03/12/stitched-grief-a-brief-history-of-mourning-embroidery/) _2026-03-12 · The Haunted Librarian · (untitled)_ Source: Mourning Embroidery by Harry Jennings, 1935/1942. This file is made available under the Creative Commons CC0 1.0 Universal Public Domain Dedication. Accessed via Wikimedia Commons. Mourning embroideries were popular in the early 1800s as a nationwide expression of grief when George Washington died in 1799. As the country mourned, many ladies took to hand stitching memento \[…\] ## [The Infamous Feejee Mermaid](https://thehauntedlibrarian.com/2026/03/12/the-infamous-feejee-mermaid-2/) _2026-03-12 · The Haunted Librarian · (untitled)_ Source: Photo of the Feejee Mermaid, photographer unknown. Public Domain due to age of photograph. Accessed via Wikimedia Commons. P.T. Barnum was the master showman. One of his stuffed creatures was the Feejee Mermaid. In a letter dated September 4, 1843, Barnum dubbed the “Fejee Mermaid the greatest curiosity in the world.” Although Barnum helped \[…\] ## [Introducing System Call Integrity Layer](https://fluxsec.red/introducing-system-call-integrity-layer) _2026-01-17 · Fluxsec.red Blog_ ## [Creating a Rust VBS Enclave DLL running in VTL1](https://fluxsec.red/creating-a-rust-application-running-in-vtl1) _2026-01-15 · Fluxsec.red Blog_ ## [Detecting Vectored Exception Handling Squared in an EDR](https://fluxsec.red/detecting-vectored-exception-handling-malware-rust-edr-windows-kernel) _2026-01-11 · Fluxsec.red Blog_ ## [Vectored Exception Handling Squared](https://fluxsec.red/vectored-exception-handling-squared-rust) _2025-12-27 · Fluxsec.red Blog_ ## [Amateur Exorcist Hickman Whittington’s Short Work](https://thehauntedlibrarian.com/2025/12/16/amateur-exorcist-hickman-whittingtons-short-work-2/) _2025-12-16 · The Haunted Librarian · (untitled)_ Amateur ghost hunting is never a good idea. Nor is paying for an advertisement to provide free exorcisms. https://open.substack.com/pub/thehauntedlibrarianfl/p/amateur-exorcist-hickman-whittingtons?r=21z538&utm\_campaign=post&utm\_medium=web&showWelcomeOnShare=true ## [Stream Torrents & IPTV Instantly (Sponsored)](https://crawlproof.com/a/pQgnRA1g14ud) _2025-12-16 · **Sponsored**_ Search magnet links and stream movies, music, books, and live TV in-browser ## [Creating a framework in Wyrm C2 to easily configure custom exports of an implant](https://fluxsec.red/creating-implant-dll-exports-wyrm-c2) _2025-11-23 · Fluxsec.red Blog_ ## [It’s that Time of Year…Krampus Night!](https://thehauntedlibrarian.com/2025/11/22/its-that-time-of-year-krampus-night/) _2025-11-22 · The Haunted Librarian · (untitled)_ Check out my updated blog on Krampus, https://thehauntedlibrarianfl.substack.com/p/krampus-the-christmastime-monster. ## [Creating a local self signed certificate for localhost testing of Wyrm C2](https://fluxsec.red/wyrm-c2-localhost-self-signed-certificate-windows) _2025-11-17 · Fluxsec.red Blog_ ## [Disassembly notes](https://fluxsec.red/disassembly-notes) _2025-11-15 · Fluxsec.red Blog_ ## [Mummy 4 and Mummy Brown](https://thehauntedlibrarian.com/2025/11/13/mummy-4-and-mummy-brown/) _2025-11-13 · The Haunted Librarian · (untitled)_ There’s a Mummy 4 coming! And did you know about the paint color Mummy Brown? Read about both here: https://substack.com/home/post/p-178831460. ## [Using Ghidriff to look at heap buffer overflow example](https://fluxsec.red/using-ghidriff-to-examine-heap-buffer-overflow) _2025-11-01 · Fluxsec.red Blog_ ## [Timestomping a PE compile timestamp - adversary tradecraft and detection](https://fluxsec.red/timestomping-pe-compile-time) _2025-10-26 · Fluxsec.red Blog_ ## [Spotify’s Mexican Gothic Is the Perfect Halloween Vibe](https://thehauntedlibrarian.com/2025/10/24/spotifys-mexican-gothic-is-the-perfect-halloween-vibe/) _2025-10-24 · The Haunted Librarian · (untitled)_ Head over to my Substack, https://thehauntedlibrarianfl.substack.com/p/spotifys-mexican-gothic-is-the-perfect. ## [Improving consistency with EDR DLL Injection via APCs](https://fluxsec.red/improving-EDR-via-windows-driver-apc-injection-rust) _2025-10-12 · Fluxsec.red Blog_ ## [Find Me on Substack!](https://thehauntedlibrarian.com/2025/10/03/find-me-on-substack/) _2025-10-03 · The Haunted Librarian · (untitled)_ Hello! I’m back writing and publishing content; however, I will be moving to Substack this year. Follow the link and subscribe to my newsletter. Link: https://thehauntedlibrarianfl.substack.com/ ## [8.1% APY Plus Free Stock (Sponsored)](https://crawlproof.com/a/UkoUPQylinDw) _2025-10-03 · **Sponsored**_ Claim 8.1% APY and up to $1,030 in SK hynix and Nvidia stock. ## [What Is a Spricket?](https://thehauntedlibrarian.com/2025/09/29/what-is-a-spricket/) _2025-09-29 · The Haunted Librarian · (untitled)_ ## [Hells Hollow: A new SSDT Hooking technique](https://fluxsec.red/hells-hollow-a-new-SSDT-hooking-technique-with-alt-syscalls-rootkit) _2025-07-28 · Fluxsec.red Blog_ ## [Inside DCHSpy: Analysing Iranian APT MuddyWater free VPN mobile spyware](https://fluxsec.red/analysing-Iranian-APT-MuddyWater-mobile-spyware-free-vpn-comodo) _2025-07-21 · Fluxsec.red Blog_ ## [Rust OPSEC for Malware Development](https://fluxsec.red/rust-opsec-malware-development) _2025-05-31 · Fluxsec.red Blog_ ## [Alt Syscalls for Windows 11](https://fluxsec.red/alt-syscalls-for-windows-11) _2025-05-11 · Fluxsec.red Blog_ ## [Making improvements to the EDR DLL injection](https://fluxsec.red/early-bird-apc-queue-injection) _2025-04-27 · Fluxsec.red Blog_ ## [Real-time Ransomware Detection Strategy](https://fluxsec.red/considering-ransomware-edr-defence-strategy) _2025-04-06 · Fluxsec.red Blog_ ## [Full spectrum Event Tracing for Windows detection in the kernel against rootkits](https://fluxsec.red/full-spectrum-event-tracing-for-windows-detection-in-the-kernel-against-rootkits) _2025-03-30 · Fluxsec.red Blog_ ## [Reverse engineering undocumented Windows Kernel features to work with the EDR](https://fluxsec.red/reverse-engineering-windows-11-kernel) _2025-03-04 · Fluxsec.red Blog_ ## [Monitoring NTDLL for in memory patching](https://fluxsec.red/monitoring-ntdll-for-memory-patching-etw-hacking-bypass-in-rust-EDR) _2025-03-02 · Fluxsec.red Blog_ ## [Every Channel. One Login. (Sponsored)](https://crawlproof.com/a/rdpIoJZAMGN3) _2025-03-02 · **Sponsored**_ 17,000+ live channels, movies and sports on any device. Free trial, no IP lock. ## [Intro and plan for the Sanctum EDR](https://fluxsec.red/sanctum-edr-intro) _2025-02-07 · Fluxsec.red Blog_ ## [Improving the Ghost Hunting implementation for flexibility and speed](https://fluxsec.red/improving-the-ghost-hunting-implementation-for-flexibility) _2025-02-06 · Fluxsec.red Blog_ ## [Hells Gate Rust - EDR Evasion with syscalls](https://fluxsec.red/rust-edr-evasion-hells-gate) _2025-02-02 · Fluxsec.red Blog_ ## [DLL Injection EDR Evasion 1: Hiding an elephant in the closet](https://fluxsec.red/dll-injection-edr-evasion-1) _2025-02-02 · Fluxsec.red Blog_ ## [EDR Evasion ETW patching in Rust](https://fluxsec.red/etw-patching-rust) _2025-02-02 · Fluxsec.red Blog_ ## [EDR Evasion APC Queue Injection in Rust](https://fluxsec.red/apc-queue-injection-rust) _2025-02-02 · Fluxsec.red Blog_ ## [Reading Event Tracing for Windows Threat Intelligence](https://fluxsec.red/event-tracing-for-windows-threat-intelligence-rust-consumer) _2025-02-02 · Fluxsec.red Blog_ ## [Windows Driver IRQL and acquiring a Driver Mutex](https://fluxsec.red/windows-rust-driver-irql-driver-mutex) _2024-12-20 · Fluxsec.red Blog_ ## [Error logging](https://fluxsec.red/logging-errors-in-rust) _2024-12-10 · Fluxsec.red Blog_ ## [Building the Driver Object](https://fluxsec.red/rust-windows-driver-object) _2024-11-03 · Fluxsec.red Blog_ ## [Configuring a Rust Windows driver](https://fluxsec.red/rust-windows-driver-configuration) _2024-10-20 · Fluxsec.red Blog_ ## [Creating a Windows Driver in Rust](https://fluxsec.red/rust-windows-driver) _2024-10-20 · Fluxsec.red Blog_ ## [Str Crypter - Payload string encryption with Rust](https://fluxsec.red/str-crypter) _2024-10-06 · Fluxsec.red Blog_ ## [Rust DLL Search Order Hijacking](https://fluxsec.red/rust-dll-search-order-hijacking) _2024-10-06 · Fluxsec.red Blog_