Marcus Tonsmann

Security Stuff | GREM GXPN GDAT GSE | NYC 🏊‍♂️🧗‍♂️⛷

[Marcus Tonsmann @_k00s]

Had an absolute blast at @WWHackinFest again this year. Crazy to think that last year #WWHF was my first con.

Slides from my talk on DoH for Attackers and Defenders are here: https://t.co/keXaWAoZ5z
Look out for a full write-up soon.

[Marcus Tonsmann @_k00s]

@seanhn Lots of buzz about GLM 5.2 cyber performance, I've yet to see a benchmark run though. Who will pay for the inference to run CyberGym, ExploitBench for these open weight models? We're talking 5-10k per run per bench. Non-trivial for individual researchers.

[Marcus Tonsmann @_k00s]

@InvokeReversing looks like they've pivoted to AI:
d611c3356b41602e07ae6919162593e1
imageryx.exe
imageryx[.]ai

[Marcus Tonsmann @_k00s]

@Cyb3rWard0g Looking forward to hearing what's next!

[Marcus Tonsmann @_k00s]

@ItsReallyNick @Ground_app @grok I have been testing out for a while and found it very illuminating. Generally slower than NYT or WSJ for push notifications but getting headlines at a glance and blindspot focus is really helpful

[Marcus Tonsmann @_k00s]

@brysonbort I think about this a lot and what it means when we talk about exec comms. It's a journey not a destination blah blah but how does a CFO/CEO/CTO/board know they are on the right trajectory when there are always budget requests on the cutting room floor?

[Marcus Tonsmann @_k00s]

@IceSolst @tuckner cc @cstanley

[Marcus Tonsmann @_k00s]

@IceSolst @tuckner FYI can scale response by retrieving the directory from $chromeprofile\Default\Local Extension Settings\pajkjnmeojmbapicmbpliphjmcekeaac on all hosts and using https://t.co/VfQokRvMIh to check for presence of keys

[Marcus Tonsmann @_k00s]

@malmoeb maybe someday MSFT/Okta will integrate #JA4 into their sign in logs... an analyst can dream @4A4133

[Marcus Tonsmann @_k00s]

@ImposeCost Architecture tour by boat on the river, Cubs game, the art institute… Ferris Bueller had the right ideas

[Marcus Tonsmann @_k00s]

@Magoo This is all I’ve seen… hopefully it stays quiet until there are strong signatures at least https://t.co/H5qMpKlW6y

[wei @XiaoWei___]

MSRC fixed a RCE bug in TCPIP module.
I found the bug several months ago.
Its score is 9.8 and exploitation is more likely. Please apply the patch immediately.

[Marcus Tonsmann @_k00s]

Could this finally be the hacking + skiing con we’ve been waiting for?

[Wild West Hackin' Fest @WWHackinFest]

Wild West Hackin’ Fest is taking its conference to new heights in 2025! Join us in Denver for Wild West Hackin’ Fest @ Mile High 2025! Pre-con training: Feb. 4-5, 2025 and conference: Feb. 5-7, 2025.
Register now! ➡ https://t.co/teZY5w5Vlw
1/2

[Marcus Tonsmann @_k00s]

For those dealing with lots of Azure Windows VMs stuck in a boot loop due to CrowdStrike - you can automate the workaround using https://t.co/LdcUYqky9v CC @NathanMcNulty @GossiTheDog

[Marcus Tonsmann @_k00s]

@gleeda Surprised to see no mentions of threat validation. When I did DE, being able to run malicious activity to validate detection was key. Ideally detection rules should be continuously validated in prod. Engineers either need access to tooling to validate or need the skills to do so

[Marcus Tonsmann @_k00s]

@NathanMcNulty Yep used that and encourage it for setting interactive retention since it will work for any new data. But it seems the only way to set *archive* retention up is by table: https://t.co/qkvGkVWIqa

[Marcus Tonsmann @_k00s]

@NathanMcNulty I was surprised to see no option to set total archive period for log analytics at the workspace level, so thought I'd share this one-liner to set across all tables:

[Marcus Tonsmann @_k00s]

@cryps1s Glad Snowflake is waking people up to the infostealer risk. The target may have been accounts without MFA this time but soon people will realize the same thing can be done with their SSO tokens...

[Marcus Tonsmann @_k00s]

@cryps1s The standard I have been suggesting is to require a compliant or at least enrolled Intune device for conditional access in Entra ID, so you can require EDR on devices with tokens. On the vendor side I want better support for token binding as well

[Marcus Tonsmann @_k00s]

@arekfurt Entire hospital systems are going down due to criminally negligent AD security defaults (designed by Microsoft) and ransomware, not medical device vulnerabilities

[Marcus Tonsmann @_k00s]

@halvarflake I've learned a lot by reading Matt Levine's Money Stuff and @patio11 Bits About Money