Father Bobcat

Shamelessly uses twitter retweets as a bookmark management tool for things I want to read later.

[Grzegorz Tworek @0gtweet]

By-design AV bypass with "dev drive" 😅
I really like this feature!
Update your detection rules if you want to spot this...

[🕳 @sekurlsa_pw]

scp.exe -S "cmd /c c:\windows\system32\calc.exe" . localhost:.

Or instead of -S use
-o ProxyCommand=

[Abdul Mhanni @abdo_mhanni]

Did an engagement sometime back where Certipy and Certify both failed to discover the ESC8 vuln due to the web enrollment endpoint being configured on a standalone/separate Web server.

I wrote about this edge case on my blog here: https://t.co/3RjopWLA18

[RedTeamVillage @RedTeamVillage_]

🚨 RTVCron Ep. 5 is LIVE NOW

🎙️ @c4ch3c4d3
Local Large Language Models

Join us for a practical walkthrough of running LLMs on your own hardware, including real constraints and strategies

📺 Watch now https://t.co/cssmAGUXE5

[Sean Metcalf @PyroTek3]

Updated my PowerShell script "Invoke-ADLabBuildOut.ps1" so it now creates AD sites, subnets, and site links (based on the created sites).

This script takes a newly built AD lab environment and makes it look like a production environment along with common security issues.
https://t.co/FmWBVVXUYN

[Co11ateral @co11ateral]

DeadMatter

Extracts LSASS credentials from memory dumps. Lightweight. Can be used to bypass AV/EDR. Usually is paired with DumpIt as both of them don't need GUI.

Tested with Microsoft Defender and Kaspersky

https://t.co/phV5wNPfBZ

@three_cube @_aircorridor #edr #apt #redteam

[Clandestine @akaclandestine]

OSCP+ / OSEP Advanced Cheatsheet v3 https://t.co/qbg3Qq7wkG

[Vaishnavi @_vmlops]

MICROSOFT OPEN-SOURCED THEIR ENTIRE SENTINEL SECURITY TOOLKIT

most teams building on azure figure out threat detection the hard way

trial and error, custom KQL, dashboards built from nothing, playbooks written by hand

nobody told them it was already done

the sentinel github repo has:

▫️ 1000+ pre-built threat detection rules
▫️ hunting queries for active threat investigation
▫️ automated response playbooks
▫️ security workbooks + dashboards
▫️ data connectors for 100s of sources

the hard part was already done

https://t.co/VHbH2pIRRe

[Octoberfest7 @Octoberfest73]

Here is my BOF POC (emphasis on POC...) of this research. As the README states it's not an operationally-ready tool, but it was neat research and I figure the code might be useful for someone else. Thanks to @lildylannn and his colleague for their work! https://t.co/MoOVepSfFd

[Doug Burks @dougburks]

Introducing a new PCAP tool - OhMyPCAP

OhMyPCAP is a standalone web application for analyzing PCAP files. View security alerts, browse network metadata (DNS, HTTP, TLS, flows), extract ASCII transcripts, and carve individual streams - all from a single-page UI.

[n00py @n00py1]

@HackingLZ https://t.co/uam8E4wwrr

Maybe useful

[Nicolas Krassas @Dinosn]

PSA: That 'Disable NTLMv1' GPO you set years ago? It’s lying to you. LmCompatibilityLevel set to 5 is not enough. https://t.co/DtaZX0MAkP

[SpecterOps @SpecterOps]

Relayed NTLM creds are powerful, if you can use them.

@senderend shows why browsers fail through ntlmrelayx SOCKS and introduces ghostsurf to make NTLM-authenticated web apps accessible.

Read more ⤵️ https://t.co/BdtzoKquD1

[DirectoryRanger @DirectoryRanger]

WMEye. tool for performing Lateral Movement using WMI and remote MSBuild Execution
https://t.co/wi9ZdNVrof

[Steve Borosh @rvrsh3ll]

@SecurityAura Yes. EDR will block "SSH.exe" bring your own named different and it works most times. Connect to a different port than 22, say 31337,443,80 to test egress and protocol inspection. Similar to this I made/use https://t.co/ANAdcUj5uI

[mthcht @mthcht2]

LOLFSAAS

Living off Free SaaS

Hundreds of SaaS platforms with free tiers, documenting abuse surface, opsec risks, authent methods, C2 framework mappings, and operational limits.

https://t.co/w6NdZ7eA8C

[NK @Nikaiw]

meet VMkatz, https://t.co/eza4AXRuFT

[RedTeamVillage @RedTeamVillage_]

PDFs aren’t just documents. They’re attack surfaces.

At RTV Overflow, @FilipiPires breaks down how attackers exploit PDFs to execute malicious JavaScript, inject shellcode, trigger heap sprays, exploit Adobe Reader, and exfiltrate data.

🗓 Feb 21, 2026
⏰ 10:00 AM

Offensive security pros won’t want to miss this.

Watch live:
https://t.co/dZ3Sx2MmSE

[Father Bobcat @0xF4B0]

@ryuketsumilly 私は歌が下手なだけで、自分が実力で負けているって分かってたよ🤣