Gavin K

building and breaking @SpecterOps | opinions are my own

[Gavin K @atomiczsec]

cloud_metadata_check - BOF to probe cloud-local metadata services (IMDS, App Service, Arc HIMDS, WireServer) that can:

- fingerprint AWS, Azure, and GCP from the current process
- report IAM and managed-identity credential snippets
- probe Azure App Service, Arc HIMDS, and WireServer extension metadata

this is very useful for SA and pivoting, by mining cred material we can see what access this instance has and use that or try to pivot further; more info commented below.

the in depth Azure coverage was provided by @s1zzzz

This is the windows BOF version, soon I will be releasing a repo similar to Adrenaline, but for Linux and macOS environments ;)

[Gavin K @atomiczsec]

@iamjasonlevin bro said "just" a picture of us at an event

[Gavin K @atomiczsec]

@SBousseaden 👀
https://t.co/9W3l4E6JfK

[Gavin K @atomiczsec]

cloud_metadata_check - BOF to probe cloud-local metadata services (IMDS, App Service, Arc HIMDS, WireServer) that can:

- fingerprint AWS, Azure, and GCP from the current process
- report IAM and managed-identity credential snippets
- probe Azure App Service, Arc HIMDS, and WireServer extension metadata

this is very useful for SA and pivoting, by mining cred material we can see what access this instance has and use that or try to pivot further; more info commented below.

the in depth Azure coverage was provided by @s1zzzz

This is the windows BOF version, soon I will be releasing a repo similar to Adrenaline, but for Linux and macOS environments ;)

[Gavin K @atomiczsec]

interesting idea here splitting model usage 👾

[Gavin K @atomiczsec]

@b_nnett very intriguing

[Gavin K @atomiczsec]

@iamjasonlevin @Jayyanginspires

[Gavin K @atomiczsec]

@theo

[Gavin K @atomiczsec]

new repo for macOS and Linux execution is almost here - everything will be released publicly here and on github in the coming days, stay tuned ;)

[Gavin K @atomiczsec]

cloud_metadata_check - BOF to probe cloud-local metadata services (IMDS, App Service, Arc HIMDS, WireServer) that can:

- fingerprint AWS, Azure, and GCP from the current process
- report IAM and managed-identity credential snippets
- probe Azure App Service, Arc HIMDS, and WireServer extension metadata

this is very useful for SA and pivoting, by mining cred material we can see what access this instance has and use that or try to pivot further; more info commented below.

the in depth Azure coverage was provided by @s1zzzz

This is the windows BOF version, soon I will be releasing a repo similar to Adrenaline, but for Linux and macOS environments ;)

[Gavin K @atomiczsec]

@lukOlejnik ministry of propaganda = @memelordtech

[Gavin K @atomiczsec]

@0xBoku @AnthropicAI let the goat cook

[Gavin K @atomiczsec]

@N7WEra thank you!!

[Gavin K @atomiczsec]

cloud_metadata_check - BOF to probe cloud-local metadata services (IMDS, App Service, Arc HIMDS, WireServer) that can:

- fingerprint AWS, Azure, and GCP from the current process
- report IAM and managed-identity credential snippets
- probe Azure App Service, Arc HIMDS, and WireServer extension metadata

this is very useful for SA and pivoting, by mining cred material we can see what access this instance has and use that or try to pivot further; more info commented below.

the in depth Azure coverage was provided by @s1zzzz

This is the windows BOF version, soon I will be releasing a repo similar to Adrenaline, but for Linux and macOS environments ;)

[Gavin K @atomiczsec]

@sec_hub93028 identities

[Gavin K @atomiczsec]

@tekbog

[Gavin K @atomiczsec]

@a16z best chart yet

[Gavin K @atomiczsec]

@weezerOSINT denied all of my cyber-adjacent requests so far. no model is as tight as this one, it is unusable - even to edit markdown files in a repo that has some tooling

[Gavin K @atomiczsec]

some example outputs of what different providers would look like:

[SpecterOps @SpecterOps]

Splunk can be daunting to new detection developers, but when used right its an exceptional tool for detecting adversaries.

@sou_predictable's guide covers how to write queries that are fast and efficient to find what you're looking for.

Check it out! ⤵️ https://t.co/7saK1d5Pq4

[Gavin K @atomiczsec]

@chompie1337 gone with the wind

[Gavin K @atomiczsec]

@techspence need more of these presentations for small and local communities 🔥