Christopher Peacock

#PurpleTeam | Ex @RaytheonTech MSSP, @SCYTHE_IO, & @GD_OTS | Taught at BlackHat & DEFCON | #100DaysofSigma | Keep exploring, keep learning, and stay curious

[Christopher Peacock @SecurePeacock]

My SANS Purple Team Series: Threat-Informed Detection Engineering Webinar with @jorgeorchilles is on YouTube!

Video: https://t.co/m856BQGemj

Blog post: https://t.co/knrcyYDAQk

[Christopher Peacock @SecurePeacock]

What do you call a technique that’s documented in the popular CTI framework?

[Christopher Peacock @SecurePeacock]

👀
https://t.co/VGBO1XnCi8

[Christopher Peacock @SecurePeacock]

Pretty interesting: retrieves the command-and-control (C2) domain from a blockchain smart contract. Instead of hardcoding the server address... queries multiple Polygon RPC endpoints defined in CONTRACT_CONFIG.RPC_HOSTS
https://t.co/rELa0eKtI0

[Christopher Peacock @SecurePeacock]

This is very interesting for those working in DFIR:
https://t.co/UwezpH9irT

[Christopher Peacock @SecurePeacock]

GenAI hype - when will we hit peak ignorance?

[Anton @Antonlovesdnb]

Dropping a new tool today: TTPRunner

- One-click Vectr deploy
- Give it a threat report, PDF, or just plain-english instructions and it'll build an execution & simulation plan for you
- Executions are tracked via notes and automatically sync'd with Vectr

Works great with: https://t.co/48oPMtajG1

Check it out! 🔽

https://t.co/sHV0TQmyaU

[Wietze @Wietze]

Can LNK files ever be trusted?

⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself.

🐬 https://t.co/VZYVaEfO07

[Christopher Peacock @SecurePeacock]

I’m gonna need a copy of coalfire’s contract template since it’s battle tested and held up in court 😆

https://t.co/OieNAuxQXy

[Christopher Peacock @SecurePeacock]

AI can help build C2s and payloads, but often this seems to be the case.

[Christopher Peacock @SecurePeacock]

“Benchmarked frontier AI models on realistic SecOps tasks using Cotool’s agent harness and the Splunk BOTSv3 dataset. GPT-5 achieved the highest accuracy (63%), while Claude Haiku-4.5 completed tasks the fastest with strong accuracy.“

https://t.co/JJGyPW6Op0

[Christopher Peacock @SecurePeacock]

👀

[Nasreddine Bencherchali @nas_bench]

PowerShell has a list of suspicious keywords. If found in a script block an automatic 4104 event will be generated regardless of logging policy :) (True for both PWSH 5/7)

Look for EID 4104 with Level 3 (Warning)

Full List: https://t.co/eWcUwACBtr

[KringleCon @KringleCon]

🎄 It’s time! The 2025 SANS Holiday Hack Challenge is officially OPEN!

Something’s off in the neighborhood… disappearing items, strange sightings, a chill in the air. ❄️

Can you uncover what’s really going on?

Play now 👉 https://t.co/J1nXesKONh

#HolidayHackChallenge

[Christopher Peacock @SecurePeacock]

Interesting worm:
https://t.co/DuVutcu1Cf

[Dwyer @_Dwyer_]

https://t.co/7NfkXxUOCI (s/o tool author: @TwoSevenOneT)

[Christopher Peacock @SecurePeacock]

IP2LoRa + Meshtastic 👀

[Christopher Peacock @SecurePeacock]

Remember that you can scan without Nmap. PowerShell can do the basics just fine.

https://t.co/tHE26XNCl7

[Sean Metcalf @PyroTek3]

If you have Active Directory Certificate Services (ADCS) in your environment, run Locksmith now!

In Active Directory Security Assessments, we have found critical security issues in *most* ADCS configurations.

The great thing about Locksmith is that it doesn't just highlight the security issues in your ADCS environment, but also provides the command to remediate it!

If you're a pentester/red teamer, Locksmith is great for you to provide remediation recommendations to your customers.

https://t.co/vvtBeeMLuR

#ActiveDirectorySecurityTip

[Microsoft Security Response Center @msftsecresponse]

Microsoft is aware of active attacks targeting on-premises SharePoint Server customers, exploiting a variant of CVE-2025-49706. This vulnerability has been assigned CVE-2025-53770.

We have outlined mitigations and detections in our blog. Our team is working urgently to release a security update and will share more details as they become available. Read the full guidance in our blog: https://t.co/KE912glIHy

[Kuba Gretzky @mrgretzky]

Watch it here:
https://t.co/sJmrK7braE

[Christopher Peacock @SecurePeacock]

@Jean_Maes_1994 @MarcOverIP I thought you’d buy it so you could burn it 😂