Hare Sudhan

Software engineer in cybersecurity. Living the best of both worlds. Open Source Contributor and Maintainer of #AtomicRedTeam

[MagicSword @magicswordio]

Same tools in every breach report for a decade. ScreenConnect. AnyDesk. Signed drivers nobody patched. The binaries Windows ships by default. Cyber security industry built LOLRMM, LOLDrivers, and LOLBAS to catalog all of it, and every year the techniques came back. Blockable. Just not being blocked by anyone.

Turns out it was on us.

June 9th · 2PM EST · The founders go live.

🎙️Join us: https://t.co/MkaQeQ9CEE

Register here for updates: https://t.co/6feNkfHsDv

[Red Canary, a Zscaler company @redcanary]

Stop wrestling with complex tool syntax. 🛠️

By leveraging MCP for Atomic Red Team, Hare shows off a "fuzzy API" that streamlines your adversary emulation workflow.

Speed up your testing—check out our latest episode of SecOps Weekly: https://t.co/1eMD4LOyPc

[MagicSword @magicswordio]

The https://t.co/GQYFpObADC project just had its biggest month ever. 🙌

In April alone, we merged 12 PRs adding 90+ new vulnerable kernel driver entries to the database. LOLDrivers now tracks 615 unique drivers across 2,121 known vulnerable samples.

Here’s what the updated security metrics dashboard shows:
✅460 samples (21.7%) load despite HVCI / Memory Integrity being enabled
✅1,523 samples (72.7%) are LOLDrivers-exclusive, meaning they are NOT covered by Microsoft’s recommended vulnerable driver blocklist
✅Only 573 samples overlap with Microsoft’s block rules

That gap matters. Legitimate signed drivers from Intel, AMD, HP, Corsair, ASUS, Dell, Clevo, Beckhoff, National Instruments, and dozens of other vendors are being actively weaponized in BYOVD (Bring Your Own Vulnerable Driver) attacks. Threat actors use these drivers to disable EDR/AV, escalate privileges, and bypass kernel security controls, all with validly signed code that Windows trusts by default.

ESET’s March 2026 research documented 54 EDR killers exploiting 35 vulnerable drivers. Akira and MedusaLocker ransomware operators are abusing ThrottleStop.sys. Process-kill drivers like DsArk64.sys (WHQL Microsoft-signed) can terminate PPL-protected processes with a single 4-byte IOCTL.

If your organization isn’t actively managing application control policies that address vulnerable drivers, you have a significant blind spot. Tools like LOLDrivers give defenders the data they need to close it.

Huge thanks to the security researchers who made this sprint possible, your contributions directly improve the defensive community’s ability to detect and block these threats.

Special thanks to @weezerOSINT , @rainbowdynamix , @DbgPrint and the KeServiceDescriptorTable project.

#BYOVD #LOLDrivers #WDAC #KernelSecurity #ThreatIntel #EDR #VulnerableDrivers

[Dodge This Security @shotgunner101]

I wanted to follow-up and let @M_haggis @nas_bench @Kostastsale @cyb3rbuff @_josehelps know that the Sysmon config for the LOLRMM framework is "effectively" complete for the primary areas of focus. I have intentions to add more filtering to it but it is.

https://t.co/pjGhu9Q9c4

[Hare Sudhan @cyb3rbuff]

🚀 Introducing LOAS: Living Off the Orchard - AppleScript

Excited to open-source LOAS (Living Off the Orchard: AppleScript) - a comprehensive library of AppleScript and JXA tests mapped to the MITRE ATT&CK® framework for macOS security testing.

Why LOAS?
Attackers increasingly leverage built-in macOS tools like AppleScript and JXA to access credentials, capture screenshots, and establish persistence—all without custom malware/tools. LOAS helps security teams test if their defenses can detect these living-off-the-land techniques.

Key Features:
🔴 Execute AppleScript and JXA tests

📦 Multiple Execution Methods: osascript, Swift, compiled binaries—each generating different endpoint logs

🔗 Atomic Red Team Integration: Pre-converted Atomic Red Team YAML format available in GitHub releases. If you already use Atomic Red Team, this would fit right into your workflow.

🤖 LLM-Ready: Compatible with Claude, ChatGPT, and Gemini for interactive exploration.
Prompt your AI to "Read https://t.co/d9V8mXUlrC. I would like to ask questions about it"

Getting Started:

Download pre-built tests from GitHub releases(https://t.co/Ai5pCxLLus) and start testing immediately. Full documentation and LLM-optimized guides available at https://t.co/8VpLJrJbCZ

🔗 GitHub: https://t.co/qjwf8NQTpC
📖 Docs: https://t.co/8VpLJrJbCZ
📝 Blog: https://t.co/GUW0KbshxT

Feedback and contributions welcome! #macOS #RedTeam #BlueTeam #AdversaryEmulation #applescript

[The Haag™ @M_haggis]

Looking to up your nation state AI agent hacking?
Check out @cyb3rbuff MCP for Atomic Red Team.
For all we know, this is what Anthropic detected!

[Hare Sudhan @cyb3rbuff]

Thanks @_JohnHammond for spreading the word about Atomic Red Team MCP! Grateful to have advocates like you and @M_haggis amplifying this tool.

For anyone curious about AI powered security testing, check out the project here:

https://t.co/lhFRGLIOya

Associated Blogposts:

https://t.co/5p5H91Cnbo

https://t.co/eaoRP2tEem

[John Hammond @_JohnHammond]

Hat tip, kudos and credit where credit is due to @cyb3rbuff , big thanks for his tool and work on this Atomic Red Team MCP server! https://t.co/SQGMwq5cdT

[Hare Sudhan @cyb3rbuff]

🚀 Part 2 is here! "Atomic Red Team MCP #2: Claude becomes C2" - Breaking Everything, Everywhere, All at Once

Taking the next step from Part 1, Part 2 shows how to orchestrate atomic tests across multiple operating systems simultaneously.

🔧 What's new:

- Deploy MCP servers on Windows, Linux, and macOS
- Centralized AI control of distributed testing infrastructure
- Cross-platform attack scenarios with unified reporting
- Purple team workflows that combine attack + detection validation

💡 Real-world example: "Execute Cloudflare tunnel atomic on Windows, Linux, and macOS. Query Splunk MCP for any Cloudflare alerts and create Jira tickets for any detection gaps found."

🎯 Why this matters: Traditional BAS tools like Caldera and OpenAEV handle multi-platform execution, but require complex configuration and manual result correlation. AI-powered orchestration brings conversational intelligence to security testing - adapting scenarios based on results and reasoning through next steps.

🔗 Repository: https://t.co/lhFRGLIOya

📖 Read the full article here: https://t.co/LFIWpNCP4K

#AtomicRedTeam #MCP #AdversaryEmulation

[Hare Sudhan @cyb3rbuff]

🚀 Just released the Atomic Red Team MCP Server!

Brings 1500+ atomic tests directly into AI assistants like Claude. Search, create & validate security tests with natural language.

✨ "Show me all mimikatz tests"
✨ "Create atomic test for Chrome credential extraction"
✨ "Generate tests from this threat intel report"

Repo: https://t.co/lhFRGLIOya

🔴 @M_haggis is demoing it on YouTube today at 1 PM EST!

📖 Read the full story to learn more about the MCP: "Claude becomes the APT"
https://t.co/32ai9ZA3Sy

#atomicredteam #mcp #adversaryemulation

Special thanks to @OrOneEqualsOne and @M_haggis for beta testing and invaluable feedback!

[AtomicsonaFriday @AtomicsonaFri]

🎃 Going live in 30 minutes!

Atomics on a Friday: Night of the Living Indicators - join us for live emulations, haunted artifacts, and MCP mayhem.

See you there… or on the recording. 👻⚛️

Twitch: https://t.co/54yXPSVO42
X
Linkedin
YT: https://t.co/B3kuKvoMyF

[Hare Sudhan @cyb3rbuff]

🚀 Just released the Atomic Red Team MCP Server!

Brings 1500+ atomic tests directly into AI assistants like Claude. Search, create & validate security tests with natural language.

✨ "Show me all mimikatz tests"
✨ "Create atomic test for Chrome credential extraction"
✨ "Generate tests from this threat intel report"

Repo: https://t.co/lhFRGLIOya

🔴 @M_haggis is demoing it on YouTube today at 1 PM EST!

📖 Read the full story to learn more about the MCP: "Claude becomes the APT"
https://t.co/32ai9ZA3Sy

#atomicredteam #mcp #adversaryemulation

Special thanks to @OrOneEqualsOne and @M_haggis for beta testing and invaluable feedback!

[AtomicsonaFriday @AtomicsonaFri]

🧪 Deep in the lab, something modular is stirring...
This Friday, on Atomics on a Friday,
we’re unleashing @cyb3rbuff Atomic Red Team MCP 💥
Think of it as the Frankenstein’s lab of atomic testing - built for automation, precision, and chaos.

https://t.co/B3kuKvoeJ7

[AtomicsonaFriday @AtomicsonaFri]

🧪 Deep in the lab, something modular is stirring...
This Friday, on Atomics on a Friday,
we’re unleashing @cyb3rbuff Atomic Red Team MCP 💥
Think of it as the Frankenstein’s lab of atomic testing - built for automation, precision, and chaos.

https://t.co/B3kuKvoeJ7

[The Haag™ @M_haggis]

Grateful that a community project like LOLRMM went from this weekend hackathon to full blown project now mentioned by CISA:
https://t.co/If5R36n1aR

[Wietze @Wietze]

Thanks to @cyb3rbuff you can now leverage https://t.co/lVBYPiftK8's contents via Invoke-ArgFuscator.

Simply install the latest version from the PowerShell Gallery and use '-Command' to specify any of the supported commands (https://t.co/kJD0dU1Twd).

🤘 https://t.co/YzGda3tqzd

[Carrie Roberts @OrOneEqualsOne]

Two openings for AI Security Distinguished Engineers at Walmart. I have worked for Walmart for 7 years and I love it. I have also worked for the hiring manger and he is awesome. https://t.co/I6EnuZBgAe

[MagicSword @magicswordio]

🚨 The RMM threat landscape is evolving! 🚨

Recent attacks, like those highlighted by @HuntressLabs 🛡️ & CERT-UA 🇺🇦, show how adversaries 🎭 weaponize RMM tools 🛠️ for persistence 🔒 & lateral movement ↔️.

🔍 Enter LOLRMM: your 🧙‍♂️ ally in detecting 👀 & preventing 🚫 RMM abuse. From identifying unauthorized tools 🚨 to building robust defenses 🛡️, LOLRMM equips your SOC with the insights 📈 needed to stay ahead of attackers.

🛡️ Stay vigilant. Stay protected.

CERT-UA: https://t.co/jZzaQaRnLD

Huntress: https://t.co/atejQguRYp

🌐 Learn more: https://t.co/nr8hZE3Zcy

#RMM #ThreatDetection #LOLRMM #Cybersecurity

It Ends with Us. 💪🔥

[Hare Sudhan @cyb3rbuff]

@M_haggis I love the grouping option https://t.co/wAtjw64PSX where you can just mention a pattern(can be wildcard too) and it groups all the dependency updates in a single PR.

[Red Canary, a Zscaler company @redcanary]

⚛️ https://t.co/cZhrIXPqRm got a facelift! Our new #AtomicRedTeam testing interface features improved search and filtering, easier test execution, and more!

📽️ Here's a guided tour: https://t.co/hgdLbFOGFZ

[Clint Gibler @clintgibler]

🛠️ Announcing LOLRMM

Living Off The Land Remote Monitoring and Management

A centralized platform for tracking and managing RMM software that often get abused by threat actors

By @M_haggis, @_josehelps, @cyb3rbuff, @Kostastsale, @nas_bench

https://t.co/Odc82GXeuX