Privacy, motorcycle, and craft beer geek. Adversarial thinker. Blue team your blue team for better red teaming.
The Interwebs
- Tweets 19,592
- Following 1,808
- Followers 1,419
- Likes 13,342
I wonder if this has any potential as a sandbox detection mechanism.
I explored the windows global device identifier (GDID) and wrote a poc, including a BoF to extract it. But the main question is: Can we patch another user's GDID ?
Repo (coff BoF, Rust/C PoC) :- github.com/5mukx/GDID-Extrac…
Read the full Research here:- zerotracelab.com/blog/gdid-w…
1
1
149
Finally. Turn your gaming rig into a password cracking monster.
1
108
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
whenever these big wp2shell vulns come out i just laugh my ass off.
red team operators can use them on authorized targets for precisely 5 seconds before they notice multiple other homies hanging out there w/ them on the host and then need to be part of the deconflict/IR process
1
5
37
7,891
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
My default assumption with coding agents is simple if you point one at a directory, assume everything in that directory could end up with the provider.
That’s also why people have been recommending containers and VMs for months. They’re not just for isolation they’re about minimizing what the agent can see.
3
5
46
3,949
COM Hijacking. Set a trap in the Windows Thumbnail Cache (CLSID {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}). Wipe the cache, and the OS triggers your DLL automatically. blog soon (have to set up my lab for c2) also ending my relationship with havoc now adaptixc2 is by nest friend lol
3
36
250
16,146
Here’s the difference between working with AI and not:
In 2025 when a web server is down, you might reboot when you see it’s out of memory.
In 2026, your agent might ask for access to the .vmem file, carve out running process memory, identify a memory leak, find the bug, patch it
1
104
MD4 hashed passwords would flag in any web app test you get anywhere. That every enterprise accepts this today is bonkers.
So let's talk about Active Directory for a minute.
🧵
First off, and most importantly, Active Directory or something like it absolutely must exist.
There are networks that should not and or cannot be connected to the Internet. Or be dependant on 3rd party-run auth stacks.
184
Meanwhile @elastic EDR just shares all of their rules on their GitHub github.com/elastic/detection… maybe this is just another lesson in NOT doing security through obscurity?
Woah!
- Step 1: Blind the EDR agent
- Step 2: Use Heavener to see what detections are firing
- Step 3: Profit?!!
Prediction: EDRs will have to stop shipping early indicators with the local agent soon😂
web.archive.org/web/20260627…
5
9
114
18,677
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
First blog post in a mini series where I look at "disposable tooling". This post shares what I have found to be useful when 1-shot'ing LLM generated Stage-0 agents for Mythic. specterops.io/blog/2026/06/2…
8
84
319
49,065
In 2012 or so, I became obsessed with “disposable computing”. Leave-behind computers with low/no attribution. Today, it’s tooling. Bespoke software for anything means your detections NEED TO focus on the technique and not the tool used to invoke it.
What happens when a new Mythic agent can be generated, tested, and deployed in ~2 hours?
@_xpn_ explores "disposable tooling" and the implications for offensive operations and defenders alike.
Check out the latest from GhostWorks ⬇️ ghst.ly/4oMyrdC
7
1,247
Building a red team log and data collection system with Fable when it starts making “fake” red team command logs.
1
85
I love this.
New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker
ALT EDRChoker run throttling EDR process list
ALT Elastic EDR blocked by EDRChoker
ALT EDRChoker run remove throttling EDR process
9
2,477
Hey, I wonder what happens if a well known org is hostile to security researchers for years?
zerodium.com/Zerodium-PGP-Ke…
2
6
44
4,284
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
We’ve shipped a security-guidance plugin for Claude Code that helps identify and fix vulnerabilities as you’re writing code.
Available for all Claude Code users. Install from the plugin marketplace (/plugins).
374
1,668
17,725
2,139,991
Ok, haven’t tested this yet, but THANK YOU
Ledger - A Cobalt Strike aggressor script that tracks every operational change made during an engagement. ✅ Services
✅ Firewall Rules
✅ Accounts
✅ Registry keys
github.com/shellkraft/Ledger
326
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
We're finally ready to talk about Flipper One — a project we've been grinding on for years and have rebuilt from scratch several times. Read blog post >>
blog.flipper.net/flipper-one…
112
538
3,972
578,991
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
MiniPlasma LPE exploit works perftectly. Elastic Defend behavior protection catches the exploit primitives involved in the chain, providing detection coverage even against fresh public exploit.
github.com/Nightmare-Eclipse…
2
43
206
14,559