Aki Jos

Cyber Security || Information Security Enthusiast || Student of the Game

[Aki Jos @Akijos]

My Series on "Active Directory Attacks & Detections" presented@ Null Mumbai Meet up is available
https://t.co/ryDNeeKFwh
Cc: @NullMumbai

[Vincent Le Toux (Paris, France) @mysmartlogon]

I just released EIDVirtual v2! 🚀

Get a virtual smart card reader that uses a real USB drive for free. It automatically simulates a GIDS applet to manage your certificates—a perfect alternative to TPM-based MS Virtual Smart Cards.

Check it out here 👇 https://t.co/SDcXAbocOt

[Karsten Hahn @struppigel]

Windows API arsenal by
@0x6970
for reversers

https://t.co/OkbYRx8wse

[Luke Turvey @TurvSec]

I don't have to use @SpecterOps Bloodhound too much.

But when I do, I want good queries and so, this is great:

https://t.co/j1tIqoCWEd

[Florian Roth ⚡️ @cyb3rops]

Wrote a set of YARA rules to detect the specific web shells dropped during the SharePoint CVE-2025-53770 exploitation.

- Cleartext and compiled variants
- Forensic artefacts in logs and on disk

Hope it helps.

Rules will be available in THOR Lite and THOR Cloud Lite shortly.

https://t.co/v27uvFhtrc

https://t.co/AaMCX5PZMD

#SharePoint #YARA #ThreatDetection #CVE202553770 #THORLite #DFIR

[SEKTOR7 Institute @SEKTOR7net]

Credentials access via Shadow Snapshots, WMI and SMB, all done remotely.

Technique implemented inside impacket framework accompanied with detection automation utilizing ETW providers: Microsoft-Windows-WMI-Activity + Microsoft-Windows-SMBServer.

A technique developed by Peter Gabaldon (@PedroGabaldon)
https://t.co/NPfU0Ushqe

#redteam #blueteam #maldev #malwaredevelopment

[Jean @Jean_Maes_1994]

@mrd0x you inspired this :P
there's an alternative scenario here too download a fake .crdownload file and then instruct them to open the file browser via downloads. but this one is fun too. I present to you all, DOWNLOADFIX

[Aki Jos @Akijos]

@techspence I would place a flag.txt on the desktop with random base64 strings inside the file to deflect the adversary 😂🫣

[Itay Cohen 🌱 @megabeets_]

I analyzed thousands of messages from 35+ suspected state-sponsored hacktivist groups using machine learning—uncovering hidden connections through writing styles, language and topics.
After a year of research, here’s what we found and how we did it. 👇
https://t.co/KUnIhAmuRa
1/

[hasherezade @hasherezade]

In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: https://t.co/nPSD841K0N

[MatheuZ @MatheuzSecurity]

https://t.co/QGsBQ6bNa8

Today an article was released that I wrote together with @humza4776466746 about Linux Kernel Rootkits, in it we talk about several very interesting things, feel free to read our article and share.

#rootkit #linux #kernel #ebpf

[Rad @rad9800]

As well as the BootExecute key under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager, any of the following work to launch native applications before win32k subsystem init so we can delete EDR files.

- BootExecuteNoPnpSync
- SetupExecute
- PlatformExecute

[Mark El-Khoury @shw0rma]

To help analyze risk posed by Chrome extensions, I wrote this Rails app: https://t.co/mYK8GnCKFv

Point it to an extension ID and it'll pull the manifest and do some light static analysis of the CRX3 contents. It then adds some context through Anthropic's Claude 3.5 API.

[Craig Rowland - Agentless Linux Security @CraigHRowland]

You can use the Linux peekfd command to spy on shells/processes. May be useful if investigating suspicious activity, but carries risk attacker may be alerted.

peekfd -n -8 -d -c <PID> 0 1 2

Shell PID and 0,1,2 are file descriptors. This is what a reverse shell would show.

[Andrea P @decoder_it]

M'm glad to release the tool I have been working hard on the last month: #KrbRelayEx
A Kerberos relay & forwarder for MiTM attacks!
>Relays Kerberos AP-REQ tickets
>Manages multiple SMB consoles
>Works on Win& Linux with .NET 8.0
>...
GitHub: https://t.co/zoN2fX6Hsc

[Aki Jos @Akijos]

@0gtweet Timeout.exe can be used to pause the program or slow down execution

[zhassulan zhussupov @cocomelonckz]

https://t.co/MEXUocpasq next one on my blog. At the request of one of my readers
#cybersecurity #infosec #cybersec #malware #malwaredev #malwareresearch #malwareanalysis #redteam #blueteam #threathunting #threatintel #cybercrime #research #winapi #cryptography

[The Haag™ @M_haggis]

PowerShell Web Access - Seems safe..

Who needs a web shell, when we can just enable PSWA?

Gist:
https://t.co/byDnuwZM1K

Ref: https://t.co/hulbJyQLuf

[Craig Rowland - Agentless Linux Security @CraigHRowland]

A great write-up on Linux process name stomping techniques from @haxrob

h/t @thoughtb0x

https://t.co/U1R4lHE02G

[Aurélien Chalot @Defte_]

So I just learnt Windows DOES A LSA HIVES BACKUPS PERIODICALY!!!!! How is it possible I learn this after 5 years of internal assessments (french ressource https://t.co/CB94lv1dUc)

[Florian Hansemann @CyberWarship]

''Bypassing EDR NTDS.dit protection using BlueTeam tools.''

#infosec #pentest #redteam #blueteam
https://t.co/rbOhBYuydW