Malware and Threat Research @ IBM X-Force
Texas
Joined August 2024
- Tweets22
- Following104
- Followers169
- Likes1.1K
Pinned Tweet
The TTD tech tree has advanced a level!
- ttd-capa-cpp: reimplementation of ttd-capa that supports code scanning
- capa-cpp: C++ reimplementation of capa with added IDA Pro plugin
Shoutout to Xusheng (@CrackmesOne) for his help!
github.com/HullaBrian/ttd-ca…
github.com/HullaBrian/capa-c…
These tools are several times more performant than previous Python-based iterations. Plus, there's much more you can get out of them!
As an example, ttd-capa-cpp has the ability to extract capabilities at the instruction level, so you can see things like PEB accesses.
Just released ttd-capa, a tool used with CAPA to extract capabilities from Time Travel Debugging (TTD) traces.
On top of that, you can create timelines of the extracted capabilities that you can navigate to in your traces!
github.com/HullaBrian/ttd-ca…
🚨Introducing EventHorizon!🚨
A framework built to arm researchers with customizable ETW telemetry and sigma-like detection and response rules! It allows you to easily retrieve ETWTI telemetry, all with a simple msi installer and included wiki.
github.com/HullaBrian/EventH…
Jonathan Beierle retweeted
Just released a new @SpecterOps blog! I discovered that during client push in SCCM env's it's possible to remotely start WebClient and coerce HTTP from site servers for a relay to LDAP resulting in hierarchy takeover when WebClient is installed! 🫠
specterops.io/blog/2026/01/1…
Just posted a new blog that provides a retrospective, research updates, and a new malware family based on the research that @_logangoins and I put on in December 2024.
I included some YARA rules and areas of detection for the provided research updates!
beierle.win/2025-08-28-A-Nig…
Jonathan Beierle retweeted
I Just documented a cool way to authenticate proxied tooling to LDAP in an AD environment using C2 payload auth context, without stealing any tickets or hashes!
Keep tooling execution off-host and away from EDR on your Red Team assessments!
specterops.io/blog/2025/08/2…
Wrapped up my first BlackHat at #blackhatusa2025!
I had a great time, learned a ton, and met a lot of amazing people
Hope to come back next year!
Jonathan Beierle retweeted
My first @SpecterOps blog!
Ever wanted to collect Active Directory information from LDAP for a Red Team?
Using LDAP's more OPSEC-considerate cousin: ADWS can be used to improve upon the already present advantages of using smaller-scaling LDAP queries.
specterops.io/blog/2025/07/2…
I just released COMmander - a .NET tool designed to provide an easy to use interface for COM and RPC based attacks. It taps into the Microsoft-Windows-RPC ETW provider and allows you to provide a customizable rule set for detections.
github.com/HullaBrian/COMman…
Last weekend I had the pleasure of competing in the regional Southwest Collegiate Cyber Defense Competition (@SWCCDC ) in Tulsa, Oklahoma, where my team got 3rd place!
This is some research that @_logangoins and I have been working on! It covers disabling EDR with WDAC and provides an overview of potential detection and mitigation techniques, as well as a custom tool to perform the attack remotely.
beierle.win/2024-12-20-Weapo…
