Can we have better implant comms please? Some ideas for different options and design ideas.
tommacdonald.co.uk/ideas-for…
Woo Claude etc.
Wrote some bumph on why cyber/red teaming needs to get better at learning from outside cyber.
tommacdonald.co.uk/what-can-…
Had an idea to hide our links and payloads behind human facial validation AI.
tommacdonald.co.uk/using-azu…
Wrote up some notes on Puppet 101 and abusing Puppet across Linux / Windows. Comes with a Lab / Repo / POCs.
tommacdonald.co.uk/abusing-p…
BaffledJimmy retweeted
New features coming in #activedirectory? Say it ain't so!!!!: learn.microsoft.com/en-us/wi…
BaffledJimmy retweeted
Scaling detection and response operations at Coinbase part 2 & 3:
🔍 Driving context into detection logic with machine and user profiles
🔧 Codifying automatic remediation for high-risk detections
📫 Automating alert triage with employees via Slackbot
coinbase.com/blog/scaling-de…
BaffledJimmy retweeted
I’ve just publicly released SQLRecon v3.3. This release includes many features that were used privately by the @xforcered Adversary Services team on real-world red team operations. Please share, enjoy, and use responsibility. Hmu if you have any questions! github.com/xforcered/SQLReco…
BaffledJimmy retweeted
Introducing ETWHash!
ETWHash is a new method and tool by @lefterispan for consuming SMB events from Event Tracing for Windows (ETW) and extracting NetNTLMv2 hashes for cracking offline.
labs.nettitude.com/blog/etwh…
BaffledJimmy retweeted
Once again everyone doesn't need red teaming. Most of the complaints on here around the topic are people using red teaming in some capacity where they would benefit from other activities instead. That doesn't mean red teaming needs to be changed or modified.
BaffledJimmy retweeted
In our latest research, @rbmaslen dives in to the LastPass password manager mdsec.co.uk/2022/10/analysin…
Hi @monoxgas the SSL cert on silentbreaksecurity domain has expired I think, HSTS stops browsing. :)
BaffledJimmy retweeted
Two of the most seemingly obvious things have made the biggest improvements on how we red team here. Standardizing sharing of notes/techniques/etc in Obsidian and having consultants debrief the entire red and research teams after every engagement is complete.
New DigitalOcean Functions, look like @FortyNorthSec AzureFunctions and @_xpn_ Lambas, and @ajpc500 Cloudflare workers just got a renewed life.
iamaredirectoronpython.ondig… is URL format, can be tied to custom domains also.
digitalocean.com/blog/introd…
BaffledJimmy retweeted
In case you missed it, here are two diagram and table to help understand and abuse NTLM relay attacks 😃 (I could use some help to finish them and do some foolproofing, but they're already helpful as is imo)
