
offsec @mcdonalds // DRIVE IMPACT OR GTFO
chicago, il
Joined September 2021
- Tweets336
- Following189
- Followers46
- Likes10.1K
"C:\Program Files\Google\Edrgay\EDRGay.exe" as an EDR killer filename - like there’s no other name in their dictionary haha😂
virustotal.com/gui/file/eeef…
virustotal.com/gui/file/2d89…
ziggooner retweeted
Dunno about you but I always run @SpecterOps certify from non-domain-joined systems.
It freaked me out that SID resolution would not work.
That is because LSA is used, which won't work in runas sessions.
Now it does SID resolution via LDAP queries:
github.com/GhostPack/Certify…
ziggooner retweeted
Today I pushed a majorly overdue feature to #x64dbg Automate and its MCP, remote debugging! Analysis targets can be isolated while driving x64dbg over the network. Full functionality is available over the wire.
Also, Linux client support 🐧🎉
sentence is too light
Peter Williams, the former Trenchant exec who stole zero-day exploits from his employer and sold them to a Russian exploit buyer, was sentenced today to 7 years and 3 months in a hearing that was partially closed to the public zetter-zeroday.com/trenchant…
wrote a quick script to help with generating draugr function hook definitions for usage in crystal palace loaders
github.com/ziggoon/draugrgen
cc @_RastaMouse
hahaha this is sick
Red Team Ops by @SpecterOps teaches Cobalt Strike while you’re being hunted by a bot that will callout and respond to bad OPSEC to reenforce good tradecraft. Wonderful course but I am bias because I work here.

































