Two Seven One Three

Chief Security Officer (CSO) || Security Researcher at || Penetration Tester || Red Teamer || Social Engineering Awareness Trainer

[Two Seven One Three @TwoSevenOneT]

@CDC_FI I think we should just focus on our class name 🤔

[Two Seven One Three @TwoSevenOneT]

PE‑OopsSec is a security utility designed to identify and flag common OPSEC mistakes hidden inside PE files
Like this: E:\Movies\Action\Not_Porn\I_Swear_Its_Not\Why_Would_I_Lie\You_Have_Trust_Issues\Told_You_So\Empty_Folder\NASA_hot_kitten.jpg.pdb

Github: TwoSevenOneT/PE-OopsSec

#redteam #antimalware #pentest

[Two Seven One Three @TwoSevenOneT]

@CDC_FI 🫡

[Two Seven One Three @TwoSevenOneT]

@kyREcon This is the demo file I normally use. The goal of the tool is to build a scanner that checks files after they are built but before deployment. Better to catch too much than to miss something critical

[Two Seven One Three @TwoSevenOneT]

Been coding a lot with AI, so now I’m creating a toolkit (also AI‑assisted 😄) to check for OPSEC mistakes in PE files before they’re used in the real world.

Both the article and the toolkit will be released soon 🤗

[Two Seven One Three @TwoSevenOneT]

@CDC_FI Yes 👍

[Two Seven One Three @TwoSevenOneT]

New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker

[Two Seven One Three @TwoSevenOneT]

@EAehorn I think you should determine which process handles the connection task to the MDE server first. I've already included it in the list, but I'm not sure it contains all the MDE processes

[Two Seven One Three @TwoSevenOneT]

@Tholgrim @0xedgerunnr TY 👍

[Two Seven One Three @TwoSevenOneT]

@Tank23x0 @cyb3rops No, I don't have a CS lab.

[Two Seven One Three @TwoSevenOneT]

@CDC_FI Yep 💪

[Two Seven One Three @TwoSevenOneT]

@osintashleyr @0x534c The Obfuscation Game ;)

[Two Seven One Three @TwoSevenOneT]

@CDC_FI 🤔

[Two Seven One Three @TwoSevenOneT]

@0x534c So fast ⚡

[Two Seven One Three @TwoSevenOneT]

@XanacR74233 Review what, my friend?

[Two Seven One Three @TwoSevenOneT]

@M43LS70M3 So, the problem may be that msmpeng.exe is not downloading files itself.

[Two Seven One Three @TwoSevenOneT]

@_i04n 👍 nice

[Two Seven One Three @TwoSevenOneT]

@0x534c Nice 👍
Can you still remotely control the client after it becomes inactive?

[Two Seven One Three @TwoSevenOneT]

@IstaPee @RossMichaels328 @Defte_ So, EDR with core rules will trigger some warnings. But the most important thing is that the client now can’t send logs to the server anymore, right?

[Two Seven One Three @TwoSevenOneT]

@CDC_FI Could I have more details about Tanium?