Steven

Working to become smarter everyday. Adversary Simulation Service Architect @SpecterOps.

[dreadnode @dreadnode]

We fine-tuned an 8B model to pop a GOAD domain…using only synthetic training data. No real networks. No frontier model distillation. Just a world model that simulates AD environments and generates realistic pentesting trajectories.

See how @shncldwll and @0xdab0 did it: https://t.co/ZTRnnR7PxO

[Jonny Johnson @JonnyJohnson_]

@_subTee reminded me that the Projected File System existed on Windows recently, so I decided to do a deep dive. Turns out - this is probably the best base technology for canary/deception features out there. There is also a splash of offensive use cases😎

@HuntressLabs Blog: https://t.co/TNmfc3iXYd

[Jonny Johnson @JonnyJohnson_]

Decided to jump on the AI train...

Today I'm releasing a blog/project called EventSight. A project that parses and analyzes EVTX files using Claude, with a feedback loop that makes it smarter over time for your specific environment.

Learned a lot building this: RAG vs Agentic RAG, ICL, prompt balancing, and more.
Blog: https://t.co/QR4oSDiLBR
GitHub: https://t.co/dhOMhoLk2e

[Nick Powers @zyn3rgy]

@Tw1sm and I did some Extended Protection for Authentication (EPA) research to enumerate when this protection will prevent your NTLM relay attacks, across multiple protocols.

We are also releasing RelayInformer - python and BOF implementations of these techniques.

🔗🧵

[Adam Chester 🏴‍☠️ @_xpn_]

New blog post is up exploring a vuln I found in Claude Code (CVE-2025-64755) allowing arbitrary file write without a consent prompt. New tech is always fun to explore, hopefully this post gives you some hints as to future research :) https://t.co/UiXp9XN5NA

[Rémi GASCOU (Podalirius) @podalirius_]

I have released an OpenGraph collector for network shares and my first blogpost at @SpecterOps on the subject!

You can now visualize attack paths to network shares in BloodHound 👀

https://t.co/2e2DBIndcU

[Nick Powers @zyn3rgy]

@Tw1sm and I will be talking about some techniques to better inform your NTLM relays later this month, and releasing a tool for the techniques shortly thereafter. If you’re interested, come join us!

[dreadnode @dreadnode]

Can we eliminate the C2 server entirely and create truly autonomous malware?

On the Dreadnode blog, Principal Security Researcher @0xdab0 details how we developed an entirely local, C2-less malware that can autonomously discover and exploit one type of privilege escalation vulnerability.

A future where fully autonomous red team assessments are powered by nothing more than a pre-installed local model and a Lua interpreter may be closer than you’d imagine.

Read about it here: https://t.co/dDcOF9jZkp

[Jonny Johnson @JonnyJohnson_]

A while back I was curious about the access check that occurs when someone tries to consume from the Threat-Intelligence ETW provider. I decided to write a short blog on the topic.

https://t.co/6cpUDSMNF5

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Steven @0xthirteen]

I came across a WMI Win_32 Process replacement with some extra useful functionality.
https://t.co/aDX8y8XZUy

[Logan Goins @_logangoins]

I Just documented a cool way to authenticate proxied tooling to LDAP in an AD environment using C2 payload auth context, without stealing any tickets or hashes!

Keep tooling execution off-host and away from EDR on your Red Team assessments!
https://t.co/VLE2Kh4idY

[SpecterOps @SpecterOps]

New blog post just dropped!

West Shepherd breaks down extending the Mythic Poseidon agent for ARM64 Dylib injection on Apple Silicon. Details include:

✅ Shellcode construction
✅ Memory allocation
✅ Runtime patching
✅ Thread creation

Read more ⤵️ https://t.co/irEVtFy2Aq

[Steven @0xthirteen]

I wanted to find out if you could start the WebClient service remotely, so I ended up digging into it https://t.co/ESjK58NXhe

[Steven @0xthirteen]

@JonnyJohnson_ does it detect when JonMon is running though?

[Raj Patel @GrayHatKiller]

Wrote a BOF that extracts access tokens from .tbres files by decrypting DPAPI blobs in the current user context, this tool can be used as an alternate to office_tokens BOF
https://t.co/9Fbm8UqOrS

[Steven @0xthirteen]

I don’t know how widely it was used, but fun fact is assemblyhunter has a way to quickly triage a host for electron apps. Sometimes false positives for apps that aren’t. I figured in the future electron would catch on 🙂

[Steven @0xthirteen]

@JonnyJohnson_ My mans out here giving out that hot magma content. This must be why I have to carry you so much in cod

[Steven @0xthirteen]

@unsigned_sh0rt Claude: “You’re absolutely right! I shouldn’t use that phrase!”

[Jonny Johnson @JonnyJohnson_]

Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been working on for the past couple months.

This dives into DCOM Interfaces that enable remote ETW trace sessions without dropping an agent to disk.

Includes a detailed write-up: https://t.co/AiSJZwu3zk

And a new GitHub project "JonMon-Lite": https://t.co/A0rtvhvZNG