Detection & Response @ Klaviyo and creator of awesome-detection-engineering, LOOBins, Rulehound, Detection Engineering AI Maturity Framework
Boston, MA
Joined February 2016
- Tweets515
- Following723
- Followers1K
- Likes2.3K
Pinned Tweet
Today I'd like to share a tool I recently wrote called Rulehound. It's a detection ruleset catalogue and search engine containing over 7,500 rules from 5 distinct sources. More details in thread.
rulehound.com
Brendan Chamberlain retweeted
as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)
🍎 New on LOOBins: loobins.io now serves /llms.txt, /llms-full.txt, and a markdown version of every binary page. Agents can now seamlessly add info from 76 macOS LOOBins to context.
Brendan Chamberlain retweeted
Anthropic has replaced Git internally.
The titans are falling.
New on our Engineering blog: Creating in-house source control.
In May, we merged around 2,500 code changes per day. In September, we merged more than 30,000 per day. As a result, we became bottlenecked by developer infrastructure built for human (rather than agent) scale.
Here, we share how we built a new version control system—and fully migrated our monorepo from git—in five months: anthropic.com/engineering/re…
Brendan Chamberlain retweeted
There are plenty of LOLBin lists, but only one page indexes all of them.
lolol.farm indexes the community's Living-Off-the-Land research in one searchable page:
- 31 projects, 21 tags, 8 platforms
- LOLBAS, GTFOBins, LOLDrivers, LoFP and more
- filter by platform or focus area
Built by @br0k3ns0und. Bookmark it for your next triage.
lolol.farm/
🍎 LOOBins in 2026 so far:
- 17 new macOS binaries (58 → 75)
- A rebuilt loobins.io: search, filters, table view, JSON download
- Multiple new contributors
- PyLOOBins now uses uv, ships with type hints, and bundles the data
Thread 🧵👇
pyloobins now bundles all 75 LOOBins and ships with type hints. Export to STIX in one command and send them to your TI platform.
Big thanks to everyone who contributed to LOOBins in 2026 🙏 @cyb3rbuff (12 new LOOBins!), the folks at Cisco Talos, Pratik, JasonPhang98, Fernando.
Brendan Chamberlain retweeted
🚨 macOS Security: LOOBins Living Off the Land Binaries 🔥
🔥 Telegram: t.me/hackinarticles
✴️ Twitter: xitter.cf/hackinarticles
If you're doing macOS Security, Red Teaming, or Threat Hunting, bookmark this.
LOOBins documents built-in macOS binaries that can potentially be abused for post-exploitation activity. The current catalog contains 62 macOS binaries mapped to different security tactics and use cases.
🔥 Explore binaries such as:
🍎 osascript — AppleScript execution
🔐 security — Keychain interaction
📸 screencapture — Screenshot capture
🌐 nscurl — File transfer
⚙️ launchctl — LaunchAgents / LaunchDaemons
🗄️ sqlite3 — Database interaction
🧩 swift — Code execution
🔎 mdfind — File discovery
📋 pbpaste — Clipboard access
🛡️ spctl — Gatekeeper/security policy management
🔑 sysadminctl — Local account management
📡 systemsetup — Remote-access configuration
🎯 Great resource for:
🔹 macOS Pentesting
🔹 Red Teaming
🔹 Threat Hunting
🔹 Detection Engineering
🔹 DFIR
🔹 MITRE ATT&CK Research
🔗 Explore LOOBins:
loobins.io/binaries/
📌 Bookmark it. Study the techniques. Build detections.
⚠️ Use offensive techniques only in authorized environments.
♻️ REPOST & SHARE with your cybersecurity community!
#LOOBins #MacOSSecurity #CyberSecurity #RedTeam #BlueTeam #ThreatHunting #Pentesting #DFIR #LivingOffTheLand #InfoSec
Brendan Chamberlain retweeted
So many people have wanted this service forever.
So much so that there are many companies that only do this.
And CF releases it as a feature.
We are expanding access to Cloudforce One's Threat Events Platform to every Cloudflare account and introducing Threat Signals. Threat Signals automatically parses open-source threat reporting, extracts structured indicators, and connects threat context directly to your WAF rules. cfl.re/4hkBxU8 #BirthdayWeek
Brendan Chamberlain retweeted
"Stop Building a 2003 #SOC with AI: Triage Must Die (Part 2)" medium.com/anton-on-security… <- this is a bit theoretical but also hopefully useful...
Brendan Chamberlain retweeted
🚨 Strong General Security Recommendation:
Try to reduce your number of public-facing listeners as much as possible. For both work and personal stuff.
That means the number of VPNs, SSH servers, public services, etc. Anything listening, especially if it’s like remote access / admin interfaces.
We should expect all public services to be far more vulnerable going forward. Or, more precisely, for AI to be able to discover and exploit those vulnerabilities.
I recommend you try to put as much as possible behind protection layers, i.e., not publicly available at all.
Brendan Chamberlain retweeted
🚀 excited to ship Numbat, an open-source Go tool for endpoint visibility into AI agent activity, with local detection, optional pre-action blocking, and forensic reconstruction.
i started it as a simple tool to collect on-disk session artifacts for local AI agents, for cases where no live telemetry was available. it quickly grew into a full D&R tool with live activity monitoring (hooks/OpenTelemetry), an on-device CEL detection engine with multi-step rules, optional enforcement, and support for desktop, CLI, and IDE agents.
please give it a try, and file issues or feature requests if you run into anything!
src: github.com/perplexityai/numb…
blog: research.perplexity.ai/artic…
Today we’re open-sourcing Numbat, an agent-detection and response layer that is designed to work across agent harnesses.
Numbat gives security teams visibility into agent activity, with controls to block selected actions before execution.
Read more: research.perplexity.ai/artic…
Brendan Chamberlain retweeted
I had an amazing time on Alex Hurtado's podcast "Detection Dispatch (Alex's Version 💛)," where we discussed LOOBins, localized & cloud detections for macOS, and internals resources!
If you're interested, you can checkout our chat here: open.spotify.com/episode/253…
Thank you so much for having me on the show!
Brendan Chamberlain retweeted
Today @ianthiel and I published Part 1 of our thesis for the future of detection and prevention in the post-Mythos world. It is an architectural shift, not just better models. It's informed by building in this space at @sublime_sec for the past several years.
Our intent with this series is to share our thinking in the hope that it reaches the right people, so we can collectively get better as defenders and protect what matters most from those who wish us harm.
I hope you'll take a look and share your thoughts: sublime.security/blog/centra…
Thank you to Zack Allen, @DAlperovitch, Haider Dost, @mark_dufresne, @filar, @riskybusiness, @rpargman, @samkscholten, @vector_sec, and @mr_cwitter for reading drafts of this.
New addition to awesome-detection-engineering worth your attention:
Agent-Threat-Rules - a 700+ rules purpose-built for AI-agent threats (prompt injection, tool abuse, etc.).
agentthreatrule.org/en/rules
Brendan Chamberlain retweeted
This is one of the more practical AI security research projects I’ve seen.
So many benchmarks out there are based on artificial data. Too clean to represent the real.
@cotoolai looked at how AI models perform on real security investigations, using real intrusion data. With real noise from users and admins.
That’s the right framing for me. AI should not be treated as a replacement for experience or judgment, but it can be useful when it helps us work more efficiently. We can then focus on harder problems.
cotool.ai/research/windows-e…
Disclaimer: Threat Hunting Labs partners with Cotool and provides real intrusion data for this research.
Brendan Chamberlain retweeted
had a rough list of local AI agent abuse techniques sitting around for a while. now that a few are showing up in the wild, cleaned it up and published it as Endpoint AI Agent Abuse (EAA).
shipping from ✈️ github.com/0x4D31/endpoint-a…
