Observed arrival · 2026-10-15

Havox: Windows internals, loaders, and detection

havox.site Visit website

Editorial interest 76/100 Selection signal · not a rating of the site

A security researcher’s portfolio of Windows internals work, adversary-emulation tools, detection engineering, and lab notes.

No snapshot available Observed 2026-10-15

Landing page captured for the 2026-10-15 issue.

For: Windows security researchers and detection engineers
Worth noticing: The page describes DynLoader’s indirect syscall variants, manual PE mapping, and optional AES-protected fileless HTTP delivery.

Field notes

The project list pairs offensive simulation work with defensive instrumentation and detection. DynLoader’s description names indirect syscall variants, manual PE mapping, PEB walking, and optional AES for fileless HTTP delivery; PlanqX EDR is explicitly marked in development. The author identifies Google SecOps, Microsoft Sentinel, and Elastic among the environments used for detection and telemetry work.

Observed signals

Read the marks

Editorial observations of this landing page, not a rating.

○OpenPublic substance visible

✦PrettyNotable craft visible

◎NicheUnusually specific use

◉HumanPersonal, local, civic, or handmade

One card from the complete issue

The Hike Before the Hike

396,902 arrived 1,000 judged 985 catalogued Enter the complete issue