I had two of the founding fathers of detection engineering on Detection Dispatch to talk about what they've been farming with the community. 🌱 LOLDrivers. LOLRMM. LOLSkills. Catalogs that track legitimate tools and components that attackers abuse, giving us a shared place to build knowledge, hunt, and detection engineer the ways of prevention.....but the conversation went somewhere I didn't expect. I've spent so much of my career thinking about detection that this episode genuinely had me rewiring my brain around app control/prevention....Prevention isn't a replacement for detection. We need both, and I think we need to talk a lot more about how they work together. That's the episode, you don't want to miss. Thank you @M_haggis & @_josehelps for the laughs 🦉 🦉 🦉 🦉 Full episode dropping this weekend, subscribe to my Youtube channel to be notified 🔔

VirusTotal is now available in ChatGPT Scan files, URLs, and domains for potential threats, right from your chat chatgpt.com/plugins/plugin_a…

After we've learned that no one actually did any cybersecurity, and they think vulnerabilities are the end game. We now learn, that nobody actually know what constitute professional software. People saw a couple of UI/UX clones and they think, its ready for mainstream. I got one word for yall -> Support

"How often have we changed the dream of progress, only to see that dream perverted? More often than not, haven't the machines we built to improve life shattered the lives of millions"

Can app control stop a malicious skill from loading? ▶️ Watch the full episode:

Hey codex build me an AI switch so I can stop claude if it goes rogue. Hey claude build me an AI switch so I can stop codex if it goes rogue. Hey @grok please verify

I'll be on PTO for 3 weeks. I request everyone to slow down in their research and attacks. We have to meaningfully cross this new AI era and align our vision for meaningful and safe future.

This is exactly how we talked about malware when we were kids after watching the Matrix for the first time.

What I'm learning on Twitter is that most people in cyber never did any actual cyber. 🤡

Save your tokens by asking your questions on social media and to colleagues. People who want to be right will take it form there.

So to be a Microsoft MVP someone has to nominate you. Who do I need to talk to 🤔

Next thing you know, cyber is on the rise 🙈

New blog: I’m in your logs now: deceiving analysts and blinding EDRs Based on my BlackHat talk from last year, so you don't have to listen to my voice ;) Some exploration into ETW spoofing and buffer pool exhaustion. medium.com/falconforce/im-in… #FalconForce #ETW #EDR #Evasion

Machine-speed attacks.... Agentic SOCs.... Autonomous everything.... Meanwhile, somewhere, an EDR is asking nicely for its process not to be killed. Also checks logs...4688 still not enabled 🙂‍↔️

Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations. An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed. research.checkpoint.com/2026…

Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public. github.com/MSNightmare/Shiel… The PoC works with the latest August 2026 patch

How long would it take you to know if a Volt Typhoon technique ran on your endpoints today? Magic-Atomics runs real adversary techniques against your actual endpoints and tells you exactly what gets blocked and what doesn't. 4,800+ tests, 172 threat groups, one clear answer per test. clone it. 60 seconds to your first verdict 👇 github.com/magicsword-io/Mag… More here: magicsword.io/blog/magic-ato…

@nas_bench joined us live to break down what an EDR killer actually is and how it works at the kernel level. Tomorrow we're back for Part 2, this time with a live demo. How easy is it to actually build one? We're showing it live. 📅July 17 · 2:00 PM EST 🔗 Register: magicsword.io/prevention-lab… ▶️ Watch EDR Killers - Part 1: piped.video/NPozyKrMj2c

Evening Run 👟

In case you missed it, Episode 6 | EDR Killers is now up. Thank you @nas_bench for joining us, great memes were shared 😂 🔗 piped.video/NPozyKrMj2c #CyberSecurity #EDR #PreventionEngineering #MagicSword