I did some garden tending:

Updated the TCG community pavilion. Added some projects and posts. Re-organized the projects section.

I also added a note about ground truth curation vs. provenance for red team use. Something I wrestled with/put some thought into.

tradecraftgarden.org/references.h...

Great blog post by @rastamouse.me on how to use Crystal Palace with Cobalt Strike's BeaconGate.

The post compares+contrasts this approach with Crystal Kit lessons learned applying 'no knowledge' evasion via a DLL loader.

The Islands of Invariance Crystal Palace now has a Yara rule generator. In this blog post, I’ll walk you through the design and evaluation of this feature. rule PageStream_rDLL_03495de1 { meta: description = “PageStre…

The Islands of Invariance

More than I ever thought I'd write about Yara signatures. Oh also, Crystal Palace has a Yara rule generator too.

aff-wg.org/2026/02/02/t...

Playing in the (Tradecraft) Garden of Beacon and finding Eden. In our latest blog, learn how to utilize Crystal Palace, an open source project from Cobalt Strike creator Raphael Mudge, to rapidly combine different capabilities to create novel loaders/PIC tradecraft.

https://ow.ly/zxMP50Y1NQ5

Discovering Tradecraft Garden by x.com/jjavierolmedo

hackpuntes.com/posts/explor...

A gentle introduction to the project and specifically using the ./link command & running examples. I'm glad the guardrails example (now follow-on loader agnostic) was called out. It's a waiting gem in the corpus.

Posting this because I’m not sure Steve is on this platform. He’s made a CLion template for Crystal Palace.

github.com/0xTriboulet/...

Tradecraft Orchestration in the Garden What’s more relaxing than a beautiful fall day, a crisp breeze, a glass of Sangria, and music from the local orchestra? Of course, I expect you answered: writing position-independent code projects …

Tradecraft Orchestration in the Garden

aff-wg.org/2025/12/01/t...

An exercise in building base architectures with Crystal Palace .spec files and configuring/layering specific tradecraft modules over them at link time.

Crystal agent 👀. CRTO II ?

Tradecraft Engineering with Aspect-Oriented Programming It’s 2025 and apparently, I’m still a Java programmer. One of the things I never liked about Java’s culture, going back many years ago, was the tendency to hype frameworks that seemed to over-engin…

Tradecraft Engineering with Aspect-Oriented Programming

@rastamouse.me pretty much predicted what was coming in his last blog post. attach (Win32 APIs), redirect (local funcs), capability right-sized IAT hooks, and PICO function exports.

Yes, attach can incept its PIC.

aff-wg.org/2025/11/10/t...

GitHub - pard0p/PICO-Implant: PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible... PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible to build a multi-stage...

PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible to build a multi-stage and modular C2 implant made of PICOs.

github.com/pard0p/PICO-...

"I did give a heads up to Elastic before publishing this post. They have taken this technique into account and are working on updates to the detection rules to catch this."

"Provided as a Crystal Palace shared library. Format inspired by @rastamouse.me 's LibTP. "

Ground truth security research.

GitHub - pard0p/LibWinHttp: LibWinHttp is a simplified WinHTTP wrapper designed as a Crystal Palace shared library for implant development. Its primary purpose is to facilitate the development of PICO... LibWinHttp is a simplified WinHTTP wrapper designed as a Crystal Palace shared library for implant development. Its primary purpose is to facilitate the development of PICO modules that require HTT...

LibWinHttp is a simplified WinHTTP wrapper designed as a Crystal Palace shared library for implant development. Its primary purpose is to facilitate the development of PICO modules that require HTTP/HTTPS transport layer communication.

github.com/pard0p/LibWi...

Tradecraft Garden’s PIC Parterre The goal of Tradecraft Garden is to separate evasion tradecraft from C2. Part of this effort involves looking for logical lines of separation. And, with PIC, I think we’ve just found one of them. T…

Tradecraft Garden’s PIC Parterre

Dynamic Function Resolution pt. 2, Say yes to the .bss, and symbol remapping.

aff-wg.org/2025/10/27/t...

And it's released! 🎉

github.com/ofasgard/exe...

I've tested it with Rubeus and Seatbelt and a variety of different arguments, and it seems to be pretty stable as far as I can tell. If anyone uses this PICO and encounters bugs or instability, please let me know!

Its growing

Weeding the Tradecraft Garden When I started work on Crystal Palace, my initial thought was to see how much I could ease development of position-independent code DLL capability loaders using the tools and manipulations possible…

Weeding the Tradecraft Garden

aff-wg.org/2025/10/13/w...

Dynamic Function Resolution for PIC(?!?), rewriting x86 PIC to fix pointers, and a shared library concept for PICOs/PIC

Analysis of a Ransomware Breach

aff-wg.org/2025/09/26/a...

Breach analysis? Breach intelligence? Industry critique? Fee-only ransomware negotiator? 100% efficacy? The story of how Microsoft worked an old problem, fucked it up, we malign the guy who told us, they fixed it, and it wasn't fixed? PtH?

""I'm also interested in looking at the Java API a bit more to see how one might build a merged capability in a more progammatic fashion (imagine a GUI where you configure & build a capability by checking/unchecking "features" to include in the final output).""

Modular PIC C2 Agents (reprise) A few months ago, I published a post called Modular PIC C2 Agents where I mused about what it could look like to build a C2 agent out of individual (modular) COFFs. The idea was to build a capability ...

Quick post on how to use the new make coff and merge commands in @raphaelmudge.bsky.social's Crystal Palace.
rastamouse.me/modular-pic-...

Beacon %25 The fourth year of Beacon: London's home of hackers, hunters and EDR dodgers.

If you're in London, Will Burgess (x.com/joehowwolf) is speaking at Beacon %25 on "Linkers and Loaders: Experiments with Crystal Palace" this Thursday.

www.eventbrite.co.uk/e/beacon-25-...

beac0n.org

From his X: "If you enjoy filthy PIC tradecraft it may be of interest!"

PIC Development Crash Course Some helpful content for writing position independent code.

Position Independent Code (PIC) Development Crash Course.

My July 2025 overview of PIC writing fundamentals.

Don't know why jump tables are bad? Got a __chkstk relocation error? Watch this video.

#GoodLuckAndHappyHacking

vimeo.com/1100089433/d...

ي

Potato exploits have been a cornerstone of local priv esc on Windows for years, but how & why do the inner starchy workings of the potatoes function?

Join @atomicchonk.bsky.social next week to understand Windows access tokens & their use in the Windows environment. ghst.ly/june-web-bsky

This is getting some attention today. Cool shellcode trick from:

My First and Last Shellcode Loader by @dobinrutis.bsky.social at HITB 2024.

H/T x.com/Jean_Maes_19...

Yo this is supercool

When James Forshaw post, you read 🫡

God tier resources for Windows Internal

codemachine.com/articles.html

Theodosius - Jit linker, Symbol Mapper, and Obfuscator Existing software protection frameworks typically operate at a small range of compilation levels. The highest level of obfuscation typically operates upon source code directly (source2source), the sec...

Good article about obfuscator
blog.back.engineering/06/05/2022/

Cobalt Strike Postex Kit The CS 4.10 update saw the introduction of the Postex Kit. This was a bit overshadowed by BeaconGate, which was also added in 4.10 (I wrote about this in my last post). The intention of this post is t...

[BLOG]
Today's post is all about Cobalt Strike's Postex Kit.
rastamouse.me/cobalt-strik...

Snowblind: The Invisible Hand of Secret Blizzard

Hack the other group’s c2 infra to use for your own campaign 👌. Interesting
blog.lumen.com/snowblind-th...