Privacy, motorcycle, and craft beer geek. Adversarial thinker. Blue team your blue team for better red teaming.
The Interwebs
Joined July 2009
- Tweets19.6K
- Following1.8K
- Followers1.4K
- Likes13.3K
I wonder if this has any potential as a sandbox detection mechanism.
I explored the windows global device identifier (GDID) and wrote a poc, including a BoF to extract it. But the main question is: Can we patch another user's GDID ?
Repo (coff BoF, Rust/C PoC) :- github.com/5mukx/GDID-Extrac…
Read the full Research here:- zerotracelab.com/blog/gdid-w…
Finally. Turn your gaming rig into a password cracking monster.
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
whenever these big wp2shell vulns come out i just laugh my ass off.
red team operators can use them on authorized targets for precisely 5 seconds before they notice multiple other homies hanging out there w/ them on the host and then need to be part of the deconflict/IR process
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
My default assumption with coding agents is simple if you point one at a directory, assume everything in that directory could end up with the provider.
That’s also why people have been recommending containers and VMs for months. They’re not just for isolation they’re about minimizing what the agent can see.
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
COM Hijacking. Set a trap in the Windows Thumbnail Cache (CLSID {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}). Wipe the cache, and the OS triggers your DLL automatically. blog soon (have to set up my lab for c2) also ending my relationship with havoc now adaptixc2 is by nest friend lol
Here’s the difference between working with AI and not:
In 2025 when a web server is down, you might reboot when you see it’s out of memory.
In 2026, your agent might ask for access to the .vmem file, carve out running process memory, identify a memory leak, find the bug, patch it
MD4 hashed passwords would flag in any web app test you get anywhere. That every enterprise accepts this today is bonkers.
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
LLMs can now reverse engineer obfuscated malware. But what happens when malware authors use LLMs to iteratively obfuscate back?
Elastic Security Labs explored the arms race between LLM-driven reverse engineering and LLM-driven obfuscation. Who wins when both sides have the same tools?
This is the question every malware analyst, detection engineer, and red or blue teamer needs to be thinking about right now.
elastic.co/security-labs/llm…
Author: @elasticseclabs
#MalwareAnalysis #ReverseEngineering #InfoSec
Meanwhile @elastic EDR just shares all of their rules on their GitHub github.com/elastic/detection… maybe this is just another lesson in NOT doing security through obscurity?
Woah!
- Step 1: Blind the EDR agent
- Step 2: Use Heavener to see what detections are firing
- Step 3: Profit?!!
Prediction: EDRs will have to stop shipping early indicators with the local agent soon😂
web.archive.org/web/20260627…
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
First blog post in a mini series where I look at "disposable tooling". This post shares what I have found to be useful when 1-shot'ing LLM generated Stage-0 agents for Mythic. specterops.io/blog/2026/06/2…
In 2012 or so, I became obsessed with “disposable computing”. Leave-behind computers with low/no attribution. Today, it’s tooling. Bespoke software for anything means your detections NEED TO focus on the technique and not the tool used to invoke it.
What happens when a new Mythic agent can be generated, tested, and deployed in ~2 hours?
@_xpn_ explores "disposable tooling" and the implications for offensive operations and defenders alike.
Check out the latest from GhostWorks ⬇️ ghst.ly/4oMyrdC
Building a red team log and data collection system with Fable when it starts making “fake” red team command logs.
I love this.
New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker
ALT EDRChoker run throttling EDR process list
ALT Elastic EDR blocked by EDRChoker
ALT EDRChoker run remove throttling EDR process
All this time people have been saying LLMs burn trees or whatever. No. Here’s one that burns burritos.
Hey, I wonder what happens if a well known org is hostile to security researchers for years?
zerodium.com/Zerodium-PGP-Ke…
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
We’ve shipped a security-guidance plugin for Claude Code that helps identify and fix vulnerabilities as you’re writing code.
Available for all Claude Code users. Install from the plugin marketplace (/plugins).
Ok, haven’t tested this yet, but THANK YOU
Ledger - A Cobalt Strike aggressor script that tracks every operational change made during an engagement. ✅ Services
✅ Firewall Rules
✅ Accounts
✅ Registry keys
github.com/shellkraft/Ledger
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
We're finally ready to talk about Flipper One — a project we've been grinding on for years and have rebuilt from scratch several times. Read blog post >>
blog.flipper.net/flipper-one…
