0xjb

Offensive Security Engineer (Red Team)

[cr3ghost @cr3ghost]

LLMs can now reverse engineer obfuscated malware. But what happens when malware authors use LLMs to iteratively obfuscate back?

Elastic Security Labs explored the arms race between LLM-driven reverse engineering and LLM-driven obfuscation. Who wins when both sides have the same tools?

This is the question every malware analyst, detection engineer, and red or blue teamer needs to be thinking about right now.

https://t.co/QURyXMRDcP

Author: @elasticseclabs

#MalwareAnalysis #ReverseEngineering #InfoSec

[0xjb @0xjbb_]

@_RastaMouse Won’t do anything, it’ll still block you 😂

[0xjb @0xjbb_]

@avx128

[0xjb @0xjbb_]

Ever wanted to find hot single SOC analysts in your area? TrollStackSpoofing now has built in one-way messaging for all your operational needs.

(I'll stop now, Sorry)

[0xjb @0xjbb_]

Your call stacks suck. Trollstackspoofing is the new meta

[0xjb @0xjbb_]

Your call stacks suck. Trollstackspoofing is the new meta

[0xjb @0xjbb_]

@_RastaMouse @domchell Undetectable to the blind, maybe.

[0xjb @0xjbb_]

@kernullist What UI library is this?

[0xjb @0xjbb_]

@_RastaMouse @cerbersec

[0xjb @0xjbb_]

@domchell I just googled it and I take back my initial comment

[0xjb @0xjbb_]

@domchell Sadly (thankfully??) not. Mostly stick to my Cheltenham kebabs.

[Steve S. @0xTriboulet]

Today was my last day working on @_CobaltStrike. I’m incredibly grateful for the opportunity to contribute to a framework and community that have meant so much to the security industry. Thank you to everyone I’ve had the chance to learn from, collaborate with, and build alongside

[Adam Chester 🏴‍☠️ @_xpn_]

And there we go, digital id… fuck sake!!

[Steve S. @0xTriboulet]

exciting stuff from @JoshB96009544

https://t.co/yL05zEHvyd

[0xjb @0xjbb_]

@d_tranman @0xTriboulet Yeah, that’s what it’s doing, checking the SharedOriginal of the pdata section

[0xjb @0xjbb_]

@0xTriboulet @_RastaMouse Sounds like I might have to switch it to Etw-Ti 😅

[0xjb @0xjbb_]

@_RastaMouse (Not really surprised)

[Connor McGarr @33y0re]

It seems like in the latest preview build(s) ETW functionality has been encapsulated in it's own DLL (ETW.dll) -e.g., ControlTrace/etc. are now exported by this DLL instead of sechost/ADVAPI32/etc. Seems to just be code re-org (for now) - but maybe the future will reveal more!

[0xjb @0xjbb_]

@_RastaMouse @domchell @DanNeidle Its okay though because Thorpe Park will only cost you £198 this summer instead of £200.