@binaryz0ne

DFIR and Adversary Simulation | All posts reflect the views and interests of the person behind this account only |

 USA
keybase.io/DFIR
Joined May 2011
  • Tweets22.3K
  • Following573
  • Followers35.2K
677Media
Please don’t lie to me… I can respect a bad decision you made, but I can’t respect a lier!
1
11
1
89
43,047
Wow these 5090s are ~7k! That’s crazy
1
1
1,458
Now they are over $8k !!!
1
251
Ali Hadi | B!n@ry retweeted
Phill Moore@phillmooreOct 11
Week 41 - 2026 #DFIR thisweekin4n6.com/2026/10/11…

Week 41 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Forensic Acquisition of MediaTek-Based Android…

thisweekin4n6.com
12
21
1,461
Ali Hadi | B!n@ry retweeted
Alexandre Borges
@ale_sp_brazilOct 6
As I promised, Exploiting Reversing (ER) series: article 10 | iOS Security Research (part 01) is available on my blog now: exploitreversing.com/2026/10… The primary source for new articles is blackstormsecurity.com/resea…, but articles will continue to be published on my blog with a one-week delay. Enjoy the reading and have an excellent day. #iOS #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #KernelSecurity
2
66
1
334
14,488
Ali Hadi | B!n@ry retweeted
Craig H. Rowland
@CraigHRowlandOct 6
I'll be giving a webinar on Linux threats and going over our awesome new Sandfly 6.0 release. Check it out below and sign up to be the first to see what we have coming. We will be dropping massive threat detection upgrades that will be sending intruders running for cover!
Sandfly Security
@SandflySecurityOct 6
Most Linux alerts aren't worth your time. A few are worth everything 👀 The hard part is telling which is which. On Tue 27 Oct, Sandfly founder Craig Rowland shares 4 questions to ask before you act on any detection. Free. ap1.hubs.ly/H01qdRl0
1
7
854
Ali Hadi | B!n@ry retweeted
Phill Moore@phillmooreOct 4
Week 40 - 2026 #DFIR thisweekin4n6.com/2026/10/04…

Week 40 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Adam at Hexacorn The boring state of stalled timelines… …

thisweekin4n6.com
13
25
1,690
Ali Hadi | B!n@ry retweeted
derek eiri 👻@MrEerieSep 30
Found Kevin S.' XWF (beta) X-Tension to load .DMG files! github.com/kev365/xways-imag…
3
6
473
If you’re a professor and your grading is: 10% quizzes 20% labs 70% exams Please reconsider it. A student’s entire semester should not be decided by 2–3 exams. Exams matter, but 70% is way too much weight for just a few days out of an entire semester.
1
2
15
2,140
Ali Hadi | B!n@ry retweeted
Alexandre Borges
@ale_sp_brazilSep 30
Exploiting Reversing (ER) Series | Article 10: iOS Security Research (part 01) 223 pages, free. The first article in the series aimed at iOS itself, and the opening of a multi-part sequence. Published on: blackstormsecurity.com/resea… This article will be published on exploitreversing.com/ next week. I would like to thank Ilfak Guilfanov (@ilfak) and Hex-Rays SA (@HexRaysSA) for the continuous support. Hope you enjoy the read! #iOS #Apple #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering
4
95
383
18,122
Ali Hadi | B!n@ry retweeted
Costin Raiu
@craiuSep 29
A cool CTI project that attempts to reconstruct the "good old" ranking algorithm of Google from the 2000s - top1m.org/ - link in your agent for a fresh daily batch of ranked domains, hostnames and IPs. From @stefant
2
16
1
52
4,224
Ali Hadi | B!n@ry retweeted
Maxim Suhanov@errno_failSep 27
* My shell script to collect data from compromised NetScalers (timelines, core dumps, etc.): github.com/msuhanov/easy_tri… * My NSE script to fingerprint the NetScaler TCP stack: github.com/msuhanov/nse/blob…

easy_triage/easy_triage_fbsd.sh at main · msuhanov/easy_triage

Scripts to triage compromised systems (Linux, ESXi, FreeBSD/NetScaler) - msuhanov/easy_triage

github.com
1
19
68
5,583
Ali Hadi | B!n@ry retweeted
Phill Moore@phillmooreSep 27
Week 39 - 2026 #DFIR thisweekin4n6.com/2026/09/27…

Week 39 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Apple Biome Forensics: Artifacts, Locations, a…

thisweekin4n6.com
13
20
1,509
Ali Hadi | B!n@ry retweeted
Arsenal Recon@ArsenalReconSep 25
Check out the first draft of our guide "Using Windows x64 to Build IntelWinFE with AIM Remote Agent" & please let us know if you have any suggestions! ArsenalRecon.com #DFIR
9
1
17
1,144
Ali Hadi | B!n@ry retweeted
Arsenal Recon@ArsenalReconSep 25
ARMWinFE & AIM Remote Agent in action!
Arsenal Recon@ArsenalReconSep 25
Have you considered building WinFE on Arm (a/k/a ARMWinFE) or perhaps tried, but were unsuccessful? Check out the first draft of our guide "Using Windows x64 to Build ARMWinFE with AIM Remote Agent." ArsenalRecon.com #DFIR
3
7
1,135
Ali Hadi | B!n@ry retweeted
Ayush Anand
@SecurityinbitsSep 25
Ever remediated the ScreenConnect implant your alert fired on and moved on? A real sample dropped two, 9 min apart. The second, self-hosted one (wonderxp[.]top:8041) shipped its own app.config: - AccessShowUnderControlBanner = false - AccessShowBalloonOnConnect = false - AccessShowSystemTrayIcon = false Every "you are being watched" cue the client shows, switched off in XML. The cloud client beside it had no app.config. Two implants means two services. Count them before you close the case.
ScreenConnect app.config with every notification setting false

ALT ScreenConnect app.config with every notification setting false

Ayush Anand
@SecurityinbitsSep 24

ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays

Article · @Securityinbits
11
1
30
3,916
Ali Hadi | B!n@ry retweeted
Haitham Alani@MroverflowSep 23
Get your copy now! a.co/d/056BSDHi
1
1
266
Ali Hadi | B!n@ry retweeted
Ruben Groenewoud
@RFGroenewoudSep 15
I wrote about some Linux Detection Engineering research: detecting local privilege escalation. Instead of chasing individual CVEs, the framework detects the behaviors they tend to share: suspicious UID changes, unexpected SUID/SGID execution, user namespace creation, and more. If you're interested, you can read my latest research here: elastic.co/security-labs/thr…

Linux Detection Engineering - Local Privilege Escalation

Linux privilege escalation detection that keys on the outcome every exploit shares: an unprivileged process runs from a writable path and becomes root.

elastic.co
1
18
69
2,704
Ali Hadi | B!n@ry retweeted
CAPE Sandbox@CapeSandboxSep 16
10 years ago today CAPE Sandbox was released... Today we are proud to announce its desktop partner-project CAPEsolo: github.com/CAPESandbox/CAPEs… 🎉 All the power of the sandbox in a desktop application 💪 pip install capesolo
7
60
1
260
14,335
Ali Hadi | B!n@ry retweeted
Phill Moore@phillmooreSep 13
Week 37 - 2026 #DFIR thisweekin4n6.com/2026/09/13…

Week 37 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Corporate Endpoint Triage: How It Works and Wh…

thisweekin4n6.com
13
16
1,289
Ali Hadi | B!n@ry retweeted
hasherezade
@hasherezadeSep 7
Time to time I see #malware unpacking tutorials using #PEsieve and *incorrectly* stating that it doesn't rebuild import table and you need to use external tools to do so. In fact it is just a matter of a commandline argument: /imp - documented on Wiki: github.com/hasherezade/pe-si…

4.3. Import table reconstruction (imp)

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches). - hasherezade/pe-sieve

github.com
7
53
1
296
15,424
Load more