kxyne

Cybersecurity/Cybercrime researcher. To hack, code straight, and tell the truth.
Tweets self destruct semi-regularly.

[kxyne @Kxyne]

@CraigHRowland A bit more fiddly in a shell script but my immediate thought was comparing /proc/$i/cmdline and "basename $( readlink -f /proc/$i/exe )". Of course if they just write a binary called [kswapd] and run that it's not very helpful, I was more thinking about cmd spoofing detection.

[kxyne @Kxyne]

@stilgherrian As someone who read this yesterday I'd very much recommend against reading it, for real.

[kxyne @Kxyne]

@cyb3rops Matching logos on the hoodies is creepy, you're right.
Glad it included a infra-red teamer in the pic though!

[kxyne @Kxyne]

@swagitda_ Eh, almost everyone has a few pets, no matter how good they are. If I was relying on running ps to see badness I'd be worried as shit but that's another topic (and one Craig definitely know about, seeing as EDR is his area).

[kxyne @Kxyne]

@snyff (vs bug bounty - most CTF is vulndev from 2005 before I was old and slow )

[kxyne @Kxyne]

@snyff Either way I come out of it with $0 and maybe a t-shirt, at least with a CTF I don't need to explain shit to 3 engineering teams :)

[kxyne @Kxyne]

@silviocesare https://t.co/YsTiu4XzFv

[kxyne @Kxyne]

@justinsteven @hash_kitten

[kxyne @Kxyne]

@j2k3k That's really inefficient, you need to batch them into PST files to make it easier to search by date and rotate to tier 2 storage (your roaming profile)

[kxyne @Kxyne]

@gamozolabs isn't this a slippery slope towards a garbage collector that follows you around asynchronously blanking your deallocated pages?

[kxyne @Kxyne]

@Cyb3rMonk @keydet89 Trying to kludge one together that fits on a slide always feels like your fighting to find a way to cut more words out, I guess I prefer more of a flowchart with a time axis? I'm never happy with how these things come out to be honest.

[kxyne @Kxyne]

@MalwareJake Passport numbers aren't real because some of them contain letters! Autism spectrum disorder can't exist because it's at least a hyperplane, not a spectrum!

[inversecos @inversecos]

Some exciting news!

I am officially announcing my NEW training company XINTRA @XintraOrg - with the FIRST COURSE ready for sign-ups:

😈Attacking and Defending Azure/M365😈

The full course is available here:
https://t.co/ScTaB732R6

I would love your support and follow <3

[kxyne @Kxyne]

@dcuthbert I advise people to use it as a composite indicator, if you see a login from an IP that scanned you then that's pretty odd. I'd never act on them alone unless they were particularly loud and/or it was a useful training exercise for a newbie

[kxyne @Kxyne]

@MalwareJake I mainly do static stuff so it's not as applicable but I keep files named by their hashes usually (no extension) and use a different background colour. I'm just ultra paranoid about dynamic so its always offline, even static is offline if its not a known thing.

[kxyne @Kxyne]

@brinlystorm *std::vector<std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>,std::allocator <std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>>> enters the chat*

[kxyne @Kxyne]

@MoralAnxiety I wonder who the "schemers" are? does he have any particular group in mind? Don't leave us hanging here review writer!

[kxyne @Kxyne]

@0K_ultra @GW_officialuk I always presumed transition was part of the process, what, they exclude 51% of the warm bodies on a planet? not very grimdark. I always figured HRT for space marines was cannon.

[kxyne @Kxyne]

@chrissanders88 We knew what tools they brought along, we needed to know what they executed, when, and if they had pivoted; goal was to determine if it was a "that's annoying" incident or an "oh no!". Ended up with high confidence of "annoying" so it was a good win.