We are releasing Tracebit @x33fcon - a POC sensor aiming to fingerprint implants in memory
using only lowlevel runtime telemetry.
No signatures, no scanning. Only pagefaults.
- Excited to be speaking at @x33fcon 2026 alongside my colleague @dphillips__. We’ll be presenting “Fingerprinting Modern C2 Implants via Runtime Telemetry” and the tool we built as part of our research. See you there!
- As presented @x33fcon, this bigger update of Hunt-Sleeping-Beacons allows enumerating pending timers and their callbacks to identify timer-based sleepmasks. Additional detection ideas included :-) github.com/thefLink/Hunt-…
- We accidently built a Sysmon compatible tool with some neat features on top, like (in)direct syscall detection & more. Without drivers, with less resource footprint & using ETW only. Curious? My team is presenting at @x33fcon in June. Come & say hello!
- Here is a little ETW based tool to play with different IOCs by ImageLoad events. I feel like proxying Kernel32!LoadLibrary through Ntdll is a very strong IOC. :-)
