Curious Mustache

Curious in both senses.

̭̱̣̪Blue Teamer by trade | (noob) Maker of things | Log Addict | SOAR | Incident Handling Playbooks are my jam | (weak) Power Lifter

[x0rz @x0rz]

I don't know, but this cybersecurity minister seems pretty wise to me 😁

[joernchen @joernchen]

1 simple fact the whole Bug Bounty industry tries to hide from you. ;-P

[Curious Mustache @CuriousSecGuy]

https://t.co/00V4dt3cDd

[Florian Roth ⚡️ @cyb3rops]

Epic
https://t.co/uuS19q1LNJ

[Curious Mustache @CuriousSecGuy]

Well that shouldn't be happening...

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

By the way, #mimikatz bypassing Windows Defender detection (like a lots of other security products) is still simple as being a little bit patient...

1. yep, they catch it without this delay...
2. yep, real time protection & cloud (without submission) are enabled

[Jake Williams @MalwareJake]

I challenge anyone to find a better illustration of security having to engineer around technical debt in an organization.

[Accidental CISO @AccidentalCISO]

Considering all the unpaid overtime I worked in recent years... I might have been better off working here, especially considering the benefits.

[Curious Mustache @CuriousSecGuy]

This is a joke, right? The world is always making fun of Americans suing everybody for everything. But murderers suing relatives of victims. The fuq?

[CBS News @CBSNews]

Louisville police officer sues Kenneth Walker, boyfriend of Breonna Taylor, for emotional distress, assault and battery https://t.co/hA3z9sobfb

[Curious Mustache @CuriousSecGuy]

Made my day.

[Curious Mustache @CuriousSecGuy]

2020 summed up in a sticker #defcon #Cybersecurity credit: #dcstickerswap 2019

[Sy Brand @TartanLlama]

Absolutely losing it at the UK spending 12 BILLION pounds on a test and trace system which stores its data in fucking MICROSOFT EXCEL

[Dirk-jan @_dirkjan]

It has a few more prerequisites, but I finally managed to get a #Zerologon exploit working that doesn't rely on resetting passwords to exploit. Use the printerbug to make DC1 connect to you, then with lots of magic relay that to DC2 directly to DRSUAPI to DCSync 😁

[Dirk-jan @_dirkjan]

So yes, Zerologon (CVE-2020-1472) is quite easy to exploit. Unauthenticated user to Domain Admin. This is really scary. Run exploit, DCSync with DC account and empty NT hash: you have Domain Admin and a broken DC.
Awesome find by Tom Tervoort 🙂. Patch patch patch!

[Belphegor @hfs_belphegor]

(1) Deny that it happened.
(2) Use doublespeak to confuse the evidence.
(3) Fire and consider pre-emptively filing suit against anyone who uses the word “breach”.
(4) Pay the ransom.

[Internet of Shit @internetofshit]

Amazon thinking that people would like to wear two always on microphones on their body feels appropriately dystopian for 2020

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Using a Local Account, and have Windows Hello PIN code configured? ('cause Microsoft says it's more secure 🤷‍♂️)

Cleartext password is in the SYSTEM vault

TPM or not

#mimikatz loves your passwords 🥰

Thank you @tijldeneut for questions on it (I was too much on PRT 🤔)

[Edward Snowden @Snowden]

Russia's most famous opposition leader, @Navalny, has been rushed to the hospital, with reports that poison is suspected. If confirmed, it is a crime against the whole of Russia. There can be no democracy without dissent.

[Curious Mustache @CuriousSecGuy]

After DC - please donate to EFF they're struggling a lot this year. Cheers! @EFF fighting for #online #privacy and #freespeech #EFF30 https://t.co/u7UjI6nAXG