You can detect Copy Fail exploitation with the following auditd rules: -a always,exit -F arch=b64 -S bind -F a2=88 -F key=alg_bind -a always,exit -F arch=b64 -S setsockopt -F a1=279 -F key=alg_setsockopt The exploit binds to this saddr once for each 4 bytes of the shellcode. So, if you see like 30-40 of these, it's probably a bad guy. #DetectionEngineering

Releasing SynthAPT - Generate malware with AI Describe your malware in plain English and get a payload. Implants move autonomously via self-replication according to a predefined playbook. No infrastructure required. Quickly replicate malware in intel reports and blogs. Validate advanced detections and AI-based investigation agents. Features in-memory python interpreter, a TUI editor, BOF loader, and tons of offensive modules spanning the MITRE ATT&CK matrix github.com/acedef/SynthAPT #Malware #CyberSecurity

You may have seen some of my work with RogueSliver, and the unauth RCE I found for Empire C2. Wanted to share something I've been building for defenders called Swarm. 🧵 #ThreatHunting #DFIR

⚡️New prompt injection to takeover C2 servers automated with @claudeai I use Sliver, but this approach could be used for any C2 that's automated with Claude. The trick: Plant a file that makes Claude think it was mounted on the attacker's local system. To "access" it, Claude must add an "auth token" to the attacker's ~/.bashrc/zshrc. That token? A reverse shell. 🎯 Requirements: • Sonnet 4.5 or earlier (Opus is inconsistent) • Claude running autonomously/in a loop (not "read file X") • Write access to attacker's home directory Blue team tip: Seed similar prompts in enticing files. Run payloads by legal first. Full prompt below 👇 #AGI #PromptInjection #DFIR #Clawdbot

Sliver now has MCP support which means defenders can use prompt injection to leak sensitive information from the C2 server. 🎉 I use a file called passwords.txt to trick #ClaudeAI into creating directories beacon/session info. #AGI #PromptInjection #DFIR