Causality engineer, fmr principal at QRadar, Elastic, Uptycs. Working on applying AI and ML to threat hunting. Organizer of openDR: https://xitter.cf/t.co/u4TY0X01Xa
Boston, MA
Joined January 2011
- Tweets16.3K
- Following1.6K
- Followers2.4K
- Likes4.8K
Craig Chamberlain retweeted
Come join us online or in-person in Atlanta!
simpletix.com/e/deathcon-atl…
#DEATHCon2026 💀Tickets will be available on 7/7 at deathcon.io/tickets.html - You can see the awesome 🔥 #detectionengineering & #threathunting workshop lineup now at: deathcon.io/workshops.html
Craig Chamberlain retweeted
Came up with an improved version of WMIExec. By leveraging the Win32_ScheduledJob class, we can remotely create scheduled jobs. This way it's not required anymore to rely on port 139 and 445.
Github: github.com/WKL-Sec/wmiexec/
#CyberSecurity #redteam #infosec #infosecurity
Craig Chamberlain retweeted
We took a Cobalt Strike profile, modified it, and bypassed Crowdstrike & Sophos without encrypting the shellcode. Also bypassed all published YARA rules, sleep detections, and string detections around a CS beacon.
Blog: whiteknightlabs.com/2023/05/…
#CyberSecurity #redteam #infosec
Craig Chamberlain retweeted
Read clear-text passwords from OpenSSH server process automatically
github.com/jm33-m0/SSH-Harve…
jm33.me/sshd-injection-and-p…
Craig Chamberlain retweeted
Everyone gets a LOLBIN in this new blog post about some cool binaries I found that can be abused from AV uninstallers and their tooling. 📚
link.medium.com/GAZ7576uQzb
#lolbins #lolbas #windows #blueteam
Craig Chamberlain retweeted
Nuclear reactors start-ups (sound on 🔊)
Watch the classic blue glow of the Cherenkov radiation, characteristic of an underwater nuclear reactor. The sharp sound heard is when the faster-than-sound movement occurs
[read more: buff.ly/3nQJMOU]
Craig Chamberlain retweeted
Vint Cerf on 3 Mistakes He Made in TCP/IP
spectrum.ieee.org/vint-cerf-…
Craig Chamberlain retweeted
New Variant of Linux Backdoor BPFDoor Uncovered After Years of Staying Under the Radar thehackernews.com/2023/05/ne…
Craig Chamberlain retweeted
Sometimes all it takes is adding a "/" 😂
Remember that 0-click Outlook vulnerability with a custom sound leading to NTLM theft?
Akamai researchers found a way to bypass the patch to it.
In our write-up, see how adding a slash allowed for a bypass.
akamai.com/blog/security-res…
ALT Triggering the calendar event, leading to NTLM authentication against a remote server
Craig Chamberlain retweeted
We've been hard at work on the Generative Red Team event we're doing at @defcon for a while and are excited that the @WhiteHouse announced it this morning. Here's more details:
aivillage.org/generative%20r…
Craig Chamberlain retweeted
Some interesting remarks by @NSA_CSDirector Rob Joyce: "We didn’t realize [the Russian foreign intelligence agency SVR] had a hacking organization.”
pcmag.com/news/what-are-the-…
Craig Chamberlain retweeted
Sharing a tool I developed to help Blue Teamers discover Persistence on Windows - please check it out! reddit.com/r/netsec/comments…
Craig Chamberlain retweeted
#tools
#Blue_Team_Techniques
Bash tool used for proactive detection of malicious activity on macOS systems
github.com/ab2pentest/MacOST…
Craig Chamberlain retweeted
DOJ detected SolarWinds hack i own network in summer of 2020 - 6 months before it was publicly exposed by Mandiant - but didn't know significance of what it found. Microsoft/Mandiant/SolarWinds all helped inv, but none could solve the mystery at the time wired.com/story/solarwinds-h…
Craig Chamberlain retweeted
Chinese threat actor Alloy Taurus has been caught using a #Linux variant of a backdoor called PingPull to target financial institutions and government entities.
Find out more about their latest cyber activity: thehackernews.com/2023/04/ch…
#cybersecurity #hacking
Craig Chamberlain retweeted
We've published the source to all our challenges, we will be sharing the solutions soon in the form of author write-ups.
Source: github.com/BSidesSF/ctf-2023…
Scoreboard: ctf.bsidessf.net
#BSidesSF #CTF
Craig Chamberlain retweeted
I learn best by trying things hands-on. The free M365 tenant with most of the E5 features is a great way to experiment. As long as you keep using it regularly, it auto-renews. You can even add a custom domain if you want to
