Tweets/views are my own.
Joined May 2009
- Tweets239
- Following462
- Followers3.5K
- Likes7.9K
Pinned Tweet
In this post, I discuss one key difference in the thinking between sophisticated adversaries and many of the red teams that try to simulate them, as well as what that means for tradecraft and tooling.
jackson_t.gitlab.io/it-depen…
Jackson T. retweeted
I don’t really talk about personal stuff on here, but this is important.
My daughter’s leukemia has relapsed. We’ve been admitted to the children’s hospital for treatment, but it’s going to be a long road. One of the potential courses of treatment is a stem cell transplant..
Pleased to see @SpecterOps onboard with shifting away from Human-Is-The-Loop decision making to approaches that can better empower operators in commercial red teams. We're all probably about a decade late to the party but better late than never. 😀
I know I haven't blogged for a bit, but I promise @tifkin_, @0xdab0, and I have been working on something cool! This is the first blog in a series on the problem set we've been tackling, leading up to what we've built to address it - "On (Structured) Data" posts.specterops.io/on-struc…
There is something about this description of contextuality that deeply resonates with my understanding of the interactions between defensive and offensive procedures.
I still think my understanding is limited, but consider the rephrasing of an excerpt from this article below:
In quantum mechanics, contextuality says that properties of particles, such as their position or polarization, only exist within the context of a measurement.
quantamagazine.org/the-spook…
> Instead of thinking of the properties of procedures as having fixed values, consider them more like words in language, whose meanings can change depending on the context: “Time flies like an arrow. Fruit flies like bananas.”
One can tell how a red team operator thinks by which word in "information technology" they put most weight on in steering their engagement activity.
“The greatest goals are achieved through minor but continuous ekkedt [sic: effort].”
This quote from Anatoly Dneprov's thought provoking short story, "The Game" (1961) has resonated with me lately.
hardproblem.ru/en/posts/Even…
Jackson T. retweeted
@the_bit_diddler showed me this blog post that I somehow missed last year. I'm blown away by well it articulates many of the challenges that are facing red teams. jackson_t.gitlab.io/it-depen…
If you haven't read it yet, worth the 5 minutes.
Jackson T. retweeted
I've long been interested in how EDRs work under the hood and how we can apply a more evidence-based approach to evasion. I'm happy to announce that I've written a book covering these topics with @nostarch which is now available for preorder 🎉
nostarch.com/book-edr
Jackson T. retweeted
Finally put pen to paper on a topic that's been irking me. Fun fact: there is no AI malware doomsday on the way, nor is there an impending arms race of AI-powered malware vs AI-powered EDR. That's just vendor-serving rhetoric. #cybersecurity #ai #InfoSecJobs
fieldeffect.com/blog/the-bra…
Here is an implementation of Monte Carlo Tree Search and how it could be used to optimize decision making for configuring shellcode loaders like @Optiv's Ivy tool.
datalore.jetbrains.com/view/…
@jamieantisocial is right. Many that don't yet see it this way maybe haven't seen how specific the defenses can be, and how specific the respones to them can be. 🧵
And yet many red teamers are encouraged do this stringing for evasion as if we're alchemists who have yet to discover chemistry.
This current culture ultimately makes our clients and stakeholders stupider, and makes things easier for skilled adversaries inclined to target them.
There is a difference in communication styles with defensive sensors, whether they are EDRs or even lasers. The words I use to describe this difference is broadcasting vs. narrowcasting. You can read more about that here:
xitter.cf/Jackson_T/status/15545…
In this post, I discuss one key difference in the thinking between sophisticated adversaries and many of the red teams that try to simulate them, as well as what that means for tradecraft and tooling.
jackson_t.gitlab.io/it-depen…