Cedric Owens

Proud Husband to @sgowens0716 and Father | Offensive Security Engineer |

[Cedric Owens @cedowens]

My latest blog post on how in memory JXA exec, dylib exec, keylogging, and other techniques look through the lens of Apple’s ESF 🔎: https://t.co/raV4jKh7lK

[Cedric Owens @cedowens]

One thing I’m being reminded of lately: the only sure foundation that I have is Jesus Christ 🙏🏽. His kingdom transcends this economy and job market 🙌🏽.

If I can help in any way during these uncertain times please reach out! Be encouraged!

[Cedric Owens @cedowens]

@xorrior Congrats bro 💪🏽

[L0Psec @L0Psec]

Alright here’s a new blog post for a new macOS malware by @AdamJKohler and I!

This was a fun one to reverse: stripped, encoded strings, persistence, and more :)

Enjoy!!

https://t.co/TH50w8Sptl

[Cedric Owens @cedowens]

@philofishal Neat!! Thanks for sharing @infosecb - FYI

[Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦 @yo_yo_yo_jbo]

What have I been doing recently? Working on a 100% automated attack simulation framework for Microsoft Defender 🛡️ called M0rphy (named after Paul Morphy the chess genius) that supports both Linux, macOS and Windows, as well as accidently finding some vulns while doing so!

[Csaba Fitzl @theevilbit]

🆕🍎My new blogpost @KandjiMDM about how Apple attempts to mitigate some installer script vulnerabilities using "Install Script Actions" and "Install Script Mutations" in the PackageKit framework.

https://t.co/Wrx0cEfGN4

[Cedric Owens @cedowens]

@_xpn_ @SpecterOps Congrats Adam!

[Cedric Owens @cedowens]

@Laughing_Mantis @_r3ggi @yo_yo_yo_jbo @theevilbit @gergely_kalman @patrickwardle Ah interesting. Yeah I have used office macros in the past for initial access but that was a few years ago.

[Wojciech Reguła @_r3ggi]

🔊 New blog post about impersonating TCC permissions via Electron apps on macOS Sonoma
https://t.co/Tg9pC313pz

[L0Psec @L0Psec]

The recent macOS malware which leverages python and ObjC has some pretty cool functionality.

How it creates the path for the .py script for killing the NotificationCenter is a fun one so let's dive in:

🧵

[Leo Pitt @_D00mfist]

Short post where I revisit NPM payloads on macOS. https://t.co/hi9aLz1zqf

[SpecterOps @SpecterOps]

Mythic just got an update! ✨

Check out @its_a_feature_'s latest blog post for a rundown of the updates made in Mythic v3.2, including:

✅ Push C2
✅ Interactive Async Tasking
✅ Dynamic File Browser

Read more! https://t.co/ncumn1ajnA

[Cedric Owens @cedowens]

@PartyD0lphin Neat! Thanks for sharing!

[Brandon Dalton @PartyD0lphin]

Dropping a quick blog post with a few videos walking through a review of how Gatekeeper looks up Notarization tickets! Calling the endpoint yourself is super quick.

https://t.co/Tcz36JWs7v

[Clint Gibler @clintgibler]

💺 SwiftBelt

A macOS enumeration tool

Stealthy: uses Swift instead of CLI tools, avoids pop-ups

Checks:
* Full disk access
* Presence of security tools
* Searches for SSH and cloud creds
* Browser history
* Slack cookies

+ more

By @cedowens #redteam

https://t.co/NeWboMXXGC

[Cedric Owens @cedowens]

@L0Psec @patrickwardle Yeah sad I’m missing it this year ☹️. Best con hands down!

[Csaba Fitzl @theevilbit]

I put all my slides, whitepapers, workbooks, etc... for all of my past workshops and talks on my blog and added links for recordings where available. Now it's all available in a single space.

https://t.co/hLq264uEN6

[Csaba Fitzl @theevilbit]

🎉🥁 The wait is over. Please welcome "Dock Tile Plugins" to the persistence club. My new favorite. 🤩 In the blog:
🍎 background and details
🍎 how to create and use
🍎 how to detect
🍎 sample code and binary

https://t.co/91FuW4w8SZ