Blue team researcher focused on all things DFIR, detection engineering, threat hunting, and data pipelines.
Joined March 2015
- Tweets1K
- Following330
- Followers478
- Likes6.2K
I am thrilled to finally release my research into the capabilities of local LLMs and their potential for use in offensive research and development. Long read, but an interesting journey!
medium.com/@omgAPT/adversari…
Mike Scutt retweeted
🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷♂️
Read Here - akamai.com/blog/security-res…
Mike Scutt retweeted
🤓 Over the past 3 years, I have been building and sharing real-world applications of AI for cybersecurity.
I just posted a blog with a recap of my public work and a few personal thoughts at the end. Take a look 👇
blog.securitybreak.io/inside…
Mike Scutt retweeted
The detailed version of our #WorstFit attack is available now! 🔥
Check it out! 👉 blog.orange.tw/posts/2025-01…
cc: @_splitline_
Our talk at #BHEU is done! Hope you all enjoyed it. 😉 A detailed blog is on the way, but in the meantime, check out the pre-alpha website worst.fit/ for early access and the slides!
Huge thanks to @BlackHatEvents and my awesome co-presenter @_splitline_! 🐈
Mike Scutt retweeted
The long awaited LOLRMM is here. All the RMM details in a single location along with detection and DFIR details.
This is a huge milestone in the detection space. ⚡🔥
This project would've never seen the light without the amazing contributions listed 💙
Check it out and start leveraging it today lolrmm.io/
🚨🔥 LOLRMM IS LIVE! 🔥🚨
The wait is over, folks! 🥳🎉
We’re thrilled to announce the official release of LOLRMM — your new go-to tool to detect and counter RMM abuse! 🕵️♂️💻
👉 Check it out NOW at LOLRMM.io 👈
This couldn’t have been possible without our amazing contributors:
@nas_bench , @Kostastsale , @cyb3rbuff , @_josehelps , and @M_haggis ! 🙌
And a HUGE thanks to the projects that paved the way:
- Steven Dick — Splunk Lookup
- @WikiJM — Ruler Project
- @mthcht — RMM
- @Cyberspooon — RMM-Catalogue
- @br0k3ns0und — Gist
- @redcanary — Surveyor
Release vid: youtube.com/watch?v=rbh7uFUI…
🔥 Dive into the full story here: medium.com/magicswordio/anno… 🔥
#CyberSec #ThreatIntel #LOLRMM
Mike Scutt retweeted
Attacking UNIX Systems via CUPS, Part I
evilsocket.net/2024/09/26/At…
Mike Scutt retweeted
Day 0 LOLRMM so far:
- StreamLit App done
- YAMLs created for 182 RMMs
- Schema done
- Jinja Template primed.
- @nas_bench slinging code.
- @_josehelps slinging code.
- OTHERS SLINGING CODE.
It's happening. It is happening.
Just a teaser... 😶🌫️
Mike Scutt retweeted
View State, The unpatchable IIS forever day being actively exploited zeroed.tech/blog/viewstate-t…
Mike Scutt retweeted
Really cool blog and definitely worth a read. Execution decoupling (or as it's called here decorrelating) is still a very powerful way to avoid getting detected.
I also never thought of doing a "ctrl+p" from regedit to print the value, that was a cool trick 🔥
Spent some time looking at logs a couple of things to look in case someone used the same.
- Using EID 307 from Microsoft-Windows-PrintService/Operational. We can see location of printed documents (even the ones saved as pdf). A weak indicator but worth a look (if not expected).
- When saving a PDF via the "Microsoft Print to PDF" from regedit. It will save it with the title "Registry Editor". (Not a very common thing). We can use a Yara rule with the string "/Title (Registry Editor)" to detect instance of the PDF on a host.
Decorrelate attack tool behaviour to avoid EDR interference. In this post, @Defte_ writes about how remote LSA secrets dumping works and retrieves a Windows computer's BOOTKEY using less common methods.
sensepost.com/blog/2024/dump…
Mike Scutt retweeted
A few weeks ago I gave a talk at @a41con on how to phish for PRTs and phishing resistant authentication methods 👀. The slides, plus a demo video on how to do this with credential phishing are now on my blog: dirkjanm.io/talks
Mike Scutt retweeted
I love the development the MDE team puts into expanding the telemetry! Our slackbot informed me JA3 / JA3S hashes are now recorded. Pretty cool for hunting and detection engineering!
Mike Scutt retweeted
#Breaking #ESETresearch releases a paper about Ebury, among the most advanced server-side Linux malware, which was deployed to 400,000 servers over the course of 15 years, primarily for financial gain. @marc_etienne_ welivesecurity.com/en/eset-r… 1/8
Mike Scutt retweeted
Mass exploitation starts with adversaries scanning the internet for vulnerable services. Why not block at the earliest possible stage in the attack chain?
Read more about JA4T in our blog (just released): blog.foxio.io/ja4t-tcp-finge…
Mike Scutt retweeted
For almost a year, invisible password spraying could be performed against any #Azure tenant due to a vulnerability in #MicrosoftGraph. In our latest blog, @nyxgeek walks us through how these attacks could have been carried out. Read it now! hubs.la/Q02vpTlN0
Mike Scutt retweeted
Full @rapid7 analysis of PAN-OS CVE-2024-3400 now available from @stephenfewer and our stellar new research teammate @ChairNectar! Spoiler: It's a two-vuln exploit chain. attackerkb.com/topics/SSTk33…
Mike Scutt retweeted
From the one and only @mvelazco 🧙♂️✨. The wizard 🪄 who brought to us:
1️⃣ Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard ❄️🌌 splunk.com/en_us/blog/securi…
2️⃣ Hunting M365 Invaders: Blue Team's Guide to Initial Access Vectors 🛡️🗺️ - splunk.com/en_us/blog/securi…
Has released msInvader 👾 to help defenders 🛡️ simulate techniques in multiple variations against M365 and Azure ☁️🔒.
Check it out:
github.com/mvelazc0/msInvade…
Check out 🚀msInvader: Simulate adversary techniques in M365 & Azure using Graph, REST, and EWS. Designed for blue teams, it helps generate attack telemetry to build, test, and enhance detection controls
🔗 github.com/mvelazc0/msInvade…
📺 youtube.com/watch?v=a6iUrufy…
#M365 #Azure #EntraID
@OTR_Community
Mike Scutt retweeted
APT Emulation Labs: NOW LIVE 🎉
Solve incidents emulating APT29, APT10 and other threat groups.
$45 per month access to ALL labs:
👀 150+ hours of lab content
👀 Disk forensics + ELK logs
👀 Hints, questions and point system
👀 7 days free trial
Labs are created & designed by industry peers:
@ZephrFish @svch0st @ippsec @DebugPrivilege @HuskyHacksMK @inversecos
Each lab comes
with scoping notes, Windows VM with forensic tools, network diagrams, disk forensics, ELK access and was created from our collective experience working in the field.
👇ACCESS THE LABS HERE 👇
xintra.org/labs
Mike Scutt retweeted
I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)
github.com/amlweems/xzbot
Mike Scutt retweeted
"Summoning RAGnarok With Your Nemesis" posts.specterops.io/summonin… I detail how we built a a Nemesis powered Retrieval-Augmented Generation (RAG) chatbot PoC, code now public at github.com/GhostPack/Ragnaro… ! Fun example of how to build on top of Nemesis' functionality.
Mike Scutt retweeted
Unfortunately, none of the excellent IOCs from Huntress[1] showed this, so I started digging and found that \App_Data\Session.db contains a load of information, including the username of who logged in, files shared, and user-agent string.
[1] huntress.com/blog/a-catastro…