BaffledJimmy

[BaffledJimmy @BaffledJimmy]

@SEKTOR7net Thanks for the shoutout dude 👍🏻👍🏻 it's MacDonald but all good 😝)

[BaffledJimmy @BaffledJimmy]

Can we have better implant comms please? Some ideas for different options and design ideas.
https://t.co/UlnkgBT4Ae

Woo Claude etc.

[BaffledJimmy @BaffledJimmy]

@HackingLZ 👀

[BaffledJimmy @BaffledJimmy]

Wrote some bumph on why cyber/red teaming needs to get better at learning from outside cyber.
https://t.co/iiVFXJPGRc

[BaffledJimmy @BaffledJimmy]

Had an idea to hide our links and payloads behind human facial validation AI.
https://t.co/rHLJpRr6VV

[BaffledJimmy @BaffledJimmy]

@domchell Haha yeh I have a funny story about that 😂

[BaffledJimmy @BaffledJimmy]

Wrote up some notes on Puppet 101 and abusing Puppet across Linux / Windows. Comes with a Lab / Repo / POCs.
https://t.co/SrmfynLnkg

[BaffledJimmy @BaffledJimmy]

@anthemtotheego @chvancooten @MarcOverIP @capt_red_beardz Would you record it and release it as a webinar or similar instead?

[Josh @passthehashbrwn]

A bunch of nerds: Your code needs to be memory safe to move the industry forward

Every CVE in 2024: if you add a funny character to this URL parameter you can execute commands as root

[BaffledJimmy @BaffledJimmy]

@domchell @assume_breach @__invictus_ Nessus down socks just takes so long these days.....

[BaffledJimmy @BaffledJimmy]

@domchell @sardaukar_77 @anthemtotheego @Jhaddix @HackingLZ Exactly this ^

TI reports are often against tiny orgs or massive lumbering orgs with crappy EDR and politics. RT is often in the echo chamber in the middle :)

[BaffledJimmy @BaffledJimmy]

@HackingLZ Most red team people have no clue on how to build enterprise cyber resiliency at scale.
They believe bypassing EDR is the be all and end all. It's an enabling action.
Most clients treat RT as point in time activities rather than 'how _could_ this play out'.

[wallfacer @simplylurking2]

I'm going to release a realistic red teaming course where we just read Confluence, wikis, shares, and git repos all day and write reports for several hours at the end.

[Darren Mar-Elia @grouppolicyguy]

New features coming in #activedirectory? Say it ain't so!!!!: https://t.co/8LyVRi5aK8

[James D @FranticTyping]

Scaling detection and response operations at Coinbase part 2 & 3:

🔍 Driving context into detection logic with machine and user profiles
🔧 Codifying automatic remediation for high-risk detections
📫 Automating alert triage with employees via Slackbot

https://t.co/vEUEWvZ6K4

[BaffledJimmy @BaffledJimmy]

@zeropointsecltd If you do CRTO you are about 500% over prepared for CCSAS 🤣.

[Sanjiv Kawa @sanjivkawa]

I’ve just publicly released SQLRecon v3.3. This release includes many features that were used privately by the @xforcered Adversary Services team on real-world red team operations. Please share, enjoy, and use responsibility. Hmu if you have any questions! https://t.co/lACpTXx94o

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Introducing ETWHash!

ETWHash is a new method and tool by @lefterispan for consuming SMB events from Event Tracing for Windows (ETW) and extracting NetNTLMv2 hashes for cracking offline.

https://t.co/wLmsQf71J8

[BaffledJimmy @BaffledJimmy]

@__invictus_ @HackingLZ One eye looking for enemy in depth 🤣

[BaffledJimmy @BaffledJimmy]

@_xpn_ @chompie1337 Pics or | out!