1<!doctype html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=robots content="noodp"><title>About - MaorSabag's Blog</title><meta name=Description content="Offensive Security Research"><meta property="og:url" content="https://maorsabag.github.io/about/"><meta property="og:site_name" content="MaorSabag's Blog"><meta property="og:title" content="About"><meta property="og:description" content="whoami Red Teamer and Security Researcher based in Israel. I specialize in adversary simulation, malware development, and breaking things in authorized environments so defenders can build better ones. 2My work spans the full offensive stack - from initial access and evasion to post-exploitation and lateral movement. Iâm particularly interested in Windows internals, EDR bypass techniques, and the low-level mechanics that make offensive tooling actually work in modern environments. 3What I Do Red Team Operations - Adversary simulation, physical and logical intrusions, full-chain attack scenarios Penetration Testing - Web, API, thick client, mobile (Android/iOS), internal network Malware Development - Shellcode loaders, EDR evasion, process injection techniques, C2 tooling Security Research - Windows internals, exception handling abuse, defense evasion primitives Teaching - Cybersecurity instructor covering Kali Linux, OSINT, and social engineering Notable Projects Project Description TrueSightKiller AV/EDR killer in C++ impacket-jump Remote service-staging tool for BOF-style lateral movement Adaptix-StealthPalace Adaptix C2 RDLL loader with Ekko sleep obfuscation and IAT hooking Paruns-Fart ntdll unhooking via Parunâs Fart technique Tech Stack Languages: C / C++ · C# · Go · Python · PowerShell · JavaScript · Java 4Platforms: Windows internals · Linux · Active Directory 5Tooling: Kali Linux · Cobalt Strike · Sliver · Havoc · Adaptix · Impacket 6Infra: AWS · Azure · Cloudflare · DigitalOcean · Terraform"><meta property="og:locale" content="en"><meta property="og:type" content="article"><meta property="article:published_time" content="2026-03-14T00:00:00+00:00"><meta property="article:modified_time" content="2026-03-14T00:00:00+00:00"><meta name=twitter:card content="summary"><meta name=twitter:title content="About"><meta name=twitter:description content="whoami Red Teamer and Security Researcher based in Israel. I specialize in adversary simulation, malware development, and breaking things in authorized environments so defenders can build better ones. 7My work spans the full offensive stack - from initial access and evasion to post-exploitation and lateral movement. Iâm particularly interested in Windows internals, EDR bypass techniques, and the low-level mechanics that make offensive tooling actually work in modern environments. 8What I Do Red Team Operations - Adversary simulation, physical and logical intrusions, full-chain attack scenarios Penetration Testing - Web, API, thick client, mobile (Android/iOS), internal network Malware Development - Shellcode loaders, EDR evasion, process injection techniques, C2 tooling Security Research - Windows internals, exception handling abuse, defense evasion primitives Teaching - Cybersecurity instructor covering Kali Linux, OSINT, and social engineering Notable Projects Project Description TrueSightKiller AV/EDR killer in C++ impacket-jump Remote service-staging tool for BOF-style lateral movement Adaptix-StealthPalace Adaptix C2 RDLL loader with Ekko sleep obfuscation and IAT hooking Paruns-Fart ntdll unhooking via Parunâs Fart technique Tech Stack Languages: C / C++ · C# · Go · Python · PowerShell · JavaScript · Java 9Platforms: Windows internals · Linux · Active Directory 10Tooling: Kali Linux · Cobalt Strike · Sliver · Havoc · Adaptix · Impacket 11Infra: AWS · Azure · Cloudflare · DigitalOcean · Terraform"><meta name=application-name content="My cool site"><meta name=apple-mobile-web-app-title content="My cool site"><meta name=referrer content="no-referrer"><meta name=theme-color content="#ffffff"><meta name=msapplication-TileColor content="#da532c"><link rel="shortcut icon" type=image/x-icon href=/favicon.ico><link rel=icon type=image/png sizes=32x32 href=/favicon-32x32.png><link rel=icon type=image/png sizes=16x16 href=/favicon-16x16.png><link rel=apple-touch-icon sizes=180x180 href=/apple-touch-icon.png><link rel=mask-icon href=/safari-pinned-tab.svg color=#5bbad5><link rel=manifest href=/site.webmanifest><link rel=canonical href=https://maorsabag.github.io/about/><link rel=stylesheet href=/css/style.min.css><link rel=preload href=https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css as=style onload='this.onload=null,this.rel="stylesheet"'><noscript><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css></noscript><link rel=preload href=https://cdn.jsdelivr.net/npm/[email protected]/animate.min.css as=style onload='this.onload=null,this.rel="stylesheet"'><noscript><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/[email protected]/animate.min.css></noscript>
11<script type=application/ld+json>{"@context":"http://schema.org","@type":"BlogPosting","headline":"About","inLanguage":"en","mainEntityOfPage":{"@type":"WebPage","@id":"https:\/\/maorsabag.github.io\/about\/"},"genre":"page","wordcount":220,"url":"https:\/\/maorsabag.github.io\/about\/","datePublished":"2026-03-14T00:00:00+00:00","dateModified":"2026-03-14T00:00:00+00:00","publisher":{"@type":"Organization","name":""},"author":{"@type":"Person","name":"xxxx"},"description":""}</script>
11</head><body data-header-desktop=fixed data-header-mobile=auto>
11<script>const query=window.matchMedia("(prefers-color-scheme: dark)");function applyTheme(){let e=window.localStorage?.getItem("theme")||"dark",t=e==="dark"||e==="auto"&&query.matches;document.body.setAttribute("theme",t?"dark":"light"),document.body.setAttribute("cfg-theme",e)}applyTheme(),query.addEventListener("change",applyTheme)</script>
11<div id=mask></div><div class=wrapper><header class=desktop id=header-desktop><div class=header-wrapper><div class=header-title><a href=/ title="MaorSabag's Blog">MaorSabag</a></div><div class=menu><div class=menu-inner><a class=menu-item href=/posts/>Posts </a><a class="menu-item active" href=/about/>About </a><span class="menu-item delimiter"></span><a href=javascript:void(0); class="menu-item theme-switch" title="Switch Theme"> 12<i class="fas fa-adjust" aria-hidden=true></i></a></div></div></div></header><header class=mobile id=header-mobile><div class=header-container><div class=header-wrapper><div class=header-title><a href=/ title="MaorSabag's Blog">MaorSabag</a></div><div class=menu-toggle id=menu-toggle-mobile><span></span><span></span><span></span></div></div><div class=menu id=menu-mobile><a class=menu-item href=/posts/ title>Posts</a><a class=menu-item href=/about/ title>About</a><a href=javascript:void(0); class="menu-item theme-switch" title="Switch Theme"> 13<i class="fas fa-adjust" aria-hidden=true></i></a></div></div></header><main class=main><div class=container><div class="page single special"><h1 class="single-title animate__animated animate__pulse animate__faster">About</h1><div class=content id=content><h1 id=whoami>whoami</h1><p>Red Teamer and Security Researcher based in Israel. I specialize in adversary simulation, malware development, and breaking things in authorized environments so defenders can build better ones.</p><p>My work spans the full offensive stack - from initial access and evasion to post-exploitation and lateral movement. I’m particularly interested in Windows internals, EDR bypass techniques, and the low-level mechanics that make offensive tooling actually work in modern environments.</p><hr><h2 id=what-i-do>What I Do</h2><ul><li><strong>Red Team Operations</strong> - Adversary simulation, physical and logical intrusions, full-chain attack scenarios</li><li><strong>Penetration Testing</strong> - Web, API, thick client, mobile (Android/iOS), internal network</li><li><strong>Malware Development</strong> - Shellcode loaders, EDR evasion, process injection techniques, C2 tooling</li><li><strong>Security Research</strong> - Windows internals, exception handling abuse, defense evasion primitives</li><li><strong>Teaching</strong> - Cybersecurity instructor covering Kali Linux, OSINT, and social engineering</li></ul><hr><h2 id=notable-projects>Notable Projects</h2><table><thead><tr><th>Project</th><th>Description</th></tr></thead><tbody><tr><td><a href=https://github.com/MaorSabag/TrueSightKiller target=_blank rel="noopener noreffer">TrueSightKiller</a></td><td>AV/EDR killer in C++</td></tr><tr><td><a href=https://github.com/MaorSabag/impacket-jump target=_blank rel="noopener noreffer">impacket-jump</a></td><td>Remote service-staging tool for BOF-style lateral movement</td></tr><tr><td><a href=https://github.com/MaorSabag/Adaptix-StealthPalace target=_blank rel="noopener noreffer">Adaptix-StealthPalace</a></td><td>Adaptix C2 RDLL loader with Ekko sleep obfuscation and IAT hooking</td></tr><tr><td><a href=https://github.com/MaorSabag/Paruns-Fart target=_blank rel="noopener noreffer">Paruns-Fart</a></td><td>ntdll unhooking via Parun’s Fart technique</td></tr></tbody></table><hr><h2 id=tech-stack>Tech Stack</h2><p><strong>Languages:</strong> C / C++ · C# · Go · Python · PowerShell · JavaScript · Java<br><strong>Platforms:</strong> Windows internals · Linux · Active Directory<br><strong>Tooling:</strong> Kali Linux · Cobalt Strike · Sliver · Havoc · Adaptix · Impacket<br><strong>Infra:</strong> AWS · Azure · Cloudflare · DigitalOcean · Terraform</p><hr><h2 id=contact>Contact</h2><ul><li><strong>GitHub:</strong> <a href=https://github.com/MaorSabag target=_blank rel="noopener noreffer">github.com/MaorSabag</a></li><li><strong>LinkedIn:</strong> <a href=https://linkedin.com/in/maor-sabag target=_blank rel="noopener noreffer">linkedin.com/in/maor-sabag</a></li></ul></div></div></div></main><footer class=footer><div class=footer-container><div class=footer-line itemscope itemtype=http://schema.org/CreativeWork><i class="far fa-copyright" aria-hidden=true></i><span itemprop=copyrightYear>2025 - 2026</span></div></div></footer></div><div id=fixed-buttons><a href=# id=back-to-top class=fixed-button title="Back to Top"><i class="fas fa-arrow-up" aria-hidden=true></i></a></div><div id=fixed-buttons-hidden><a href=# id=view-comments class=fixed-button title="View Comments"><i class="fas fa-comment" aria-hidden=true></i></a></div><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/[email protected]/css/lightgallery-bundle.min.css>
13<script src=https://cdn.jsdelivr.net/npm/[email protected]/lazysizes.min.js></script>
13<script src=https://cdn.jsdelivr.net/npm/[email protected]/lightgallery.min.js></script>
13<script src=https://cdn.jsdelivr.net/npm/[email protected]/plugins/thumbnail/lg-thumbnail.min.js></script>
13<script src=https://cdn.jsdelivr.net/npm/[email protected]/plugins/zoom/lg-zoom.min.js></script>
13<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/clipboard.min.js></script>
13<script>window.config={comment:{},lightgallery:!0}</script>
13<script src=/js/theme.js></script>
13</body></html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.