We fine-tuned an 8B model to pop a GOAD domain…using only synthetic training data. No real networks. No frontier model distillation. Just a world model that simulates AD environments and generates realistic pentesting trajectories.
See how @shncldwll and @0xdab0 did it: https://t.co/ZTRnnR7PxO
@_subTee reminded me that the Projected File System existed on Windows recently, so I decided to do a deep dive. Turns out - this is probably the best base technology for canary/deception features out there. There is also a splash of offensive use cases😎
@HuntressLabs Blog: https://t.co/TNmfc3iXYd
Decided to jump on the AI train...
Today I'm releasing a blog/project called EventSight. A project that parses and analyzes EVTX files using Claude, with a feedback loop that makes it smarter over time for your specific environment.
Learned a lot building this: RAG vs Agentic RAG, ICL, prompt balancing, and more.
Blog: https://t.co/QR4oSDiLBR
GitHub: https://t.co/dhOMhoLk2e
@Tw1sm and I did some Extended Protection for Authentication (EPA) research to enumerate when this protection will prevent your NTLM relay attacks, across multiple protocols.
We are also releasing RelayInformer - python and BOF implementations of these techniques.
🔗🧵
New blog post is up exploring a vuln I found in Claude Code (CVE-2025-64755) allowing arbitrary file write without a consent prompt. New tech is always fun to explore, hopefully this post gives you some hints as to future research :) https://t.co/UiXp9XN5NA
I have released an OpenGraph collector for network shares and my first blogpost at @SpecterOps on the subject!
You can now visualize attack paths to network shares in BloodHound 👀
https://t.co/2e2DBIndcU
@Tw1sm and I will be talking about some techniques to better inform your NTLM relays later this month, and releasing a tool for the techniques shortly thereafter. If you’re interested, come join us!
Can we eliminate the C2 server entirely and create truly autonomous malware?
On the Dreadnode blog, Principal Security Researcher @0xdab0 details how we developed an entirely local, C2-less malware that can autonomously discover and exploit one type of privilege escalation vulnerability.
A future where fully autonomous red team assessments are powered by nothing more than a pre-installed local model and a Lua interpreter may be closer than you’d imagine.
Read about it here: https://t.co/dDcOF9jZkp
A while back I was curious about the access check that occurs when someone tries to consume from the Threat-Intelligence ETW provider. I decided to write a short blog on the topic.
https://t.co/6cpUDSMNF5
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3
I Just documented a cool way to authenticate proxied tooling to LDAP in an AD environment using C2 payload auth context, without stealing any tickets or hashes!
Keep tooling execution off-host and away from EDR on your Red Team assessments!
https://t.co/VLE2Kh4idY
New blog post just dropped!
West Shepherd breaks down extending the Mythic Poseidon agent for ARM64 Dylib injection on Apple Silicon. Details include:
✅ Shellcode construction
✅ Memory allocation
✅ Runtime patching
✅ Thread creation
Read more ⤵️ https://t.co/irEVtFy2Aq
Wrote a BOF that extracts access tokens from .tbres files by decrypting DPAPI blobs in the current user context, this tool can be used as an alternate to office_tokens BOF
https://t.co/9Fbm8UqOrS
I don’t know how widely it was used, but fun fact is assemblyhunter has a way to quickly triage a host for electron apps. Sometimes false positives for apps that aren’t. I figured in the future electron would catch on 🙂
Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been working on for the past couple months.
This dives into DCOM Interfaces that enable remote ETW trace sessions without dropping an agent to disk.
Includes a detailed write-up: https://t.co/AiSJZwu3zk
And a new GitHub project "JonMon-Lite": https://t.co/A0rtvhvZNG