Luca

[Nathan McNulty @NathanMcNulty]

Defender AV's ASR rules really are fantastic, great way to break attacker tools while still allowing your apps to work

I need to update my blog, but the core is there - KQL queries to help build your allow lists and get it done

https://t.co/Di1lfwkrWD

Some lessons learned 🧵

[0xdf @0xdf_]

AI vocabulary is moving fast and getting muddled. New glossary covering LLMs, models, tokens, MCPs, frontier vs open-weight labs, clients, harnesses, and lab initiatives. One of many neat cheatsheets on 0xdf hacks stuff.

https://t.co/pPtsAIFs23

[SEKTOR7 Institute @SEKTOR7net]

Intercept Windows Named Pipes comms with HTTP proxy.

pipe-intercept - a tool by Gabriel Sztejnworcel (@sztejnworcel)

Source: https://t.co/XG9kA48GVC

#redteam #blueteam #maldev #malwaredevelopment

[N_{Dario Fadda} @nuke86]

CVE-2026-0257: Palo Alto GlobalProtect sotto attacco — cookies bypassano l’autenticazione VPN
il blog: https://t.co/ma2DTRuxSh

#cybersecurity #cisakev #globalprotect #infosec #paloaltonetworks #vpn #zeroday

[cr3ghost @cr3ghost]

Alexandre Borges has published over 700 pages of free security, malware and vulnerability research.

A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085.

No paywall. No course. Just research. Free as in beer.

https://t.co/x516DQRcB8

Author: @ale_sp_brazil

#ReverseEngineering #MalwareAnalysis #InfoSec

[Andrew @4ndr3w6S]

Round two!

Yesterday was one report, here’s another: an unpatched NTLM coercion via the Windows Search (search-ms://) URI handler.

Same questions about how it got handled. It’s all in the writeup, timeline included.

https://t.co/eMbyEGbx8b

[Michael Niehaus @mniehaus]

Time to move to Entra Cloud Sync https://t.co/Mw49YaEisR

[International Cyber Digest @IntCyberDigest]

‼️ After the MSRC blog post about Nightmare-Eclipse, researchers are coming forward with their own MSRC horror stories.

The response from the security community isn't going Microsoft's way. As they’re not backing Microsoft.

Gabriel Landau, a well-known Windows security researcher, says he reported a Device Guard bypass with a 90-day window. MSRC told him it met their bar and they'd fix it, then asked him to hold disclosure for extra months. He agreed on the condition they issue a CVE. They patched it silently, decided after the fact it "didn't meet the bar," and never issued the CVE. In his words: "MSRC strung me along for a few extra months to keep me quiet, then broke their word."

Another researcher, rootsecdev, says he responsibly disclosed a legacy-auth flaw that allowed password spraying while avoiding smart lockout. Five months later, MSRC replied that it "doesn't meet the bar for servicing," silently fixed it, and closed the case.

Microsoft's post was meant to defend their coordinated disclosure policy. Instead it became a thread of researchers explaining why they've stopped trusting their process.

[spencer @techspence]

If I were a sysadmin these would be the first few deception assets I would setup:

1. Fake unattend.xml file on all hosts
2. Fake mRemote config file in an IT access only share
3. Fake server admin account with the password in the description field
4. Fake Kerberoastable admin account
5. JS on all login pages to detect cloning

Super quick and easy to set all those up and all would be super high fidelity alerts.

[Florian Hansemann @CyberWarship]

''GitHub - nikaiw/VMkatz: Extract Windows credentials directly from VM memory snapshots and virtual disks''

#infosec #pentest #redteam #blueteam
https://t.co/XzKe9I5h68

[BallisKit @BallisKit]

We updated our Sliver C2 + BallisKit tutorial to adapt to the latest Sliver version.
Learn how to use ShellcodePack/MacroPack to harden Sliver implants and turn them into initial access payloads!
More C2 tutorials available on the blog (Adaptix, Mythic)

https://t.co/9B2trqBSyk

[Core Impact @_CoreImpact]

Impacket 0.13.1 is live! This release includes new relay surfaces, stronger support for modern Windows and SQL Server environments, and a set of practical improvements across the examples scripts. Check out the blog post to get more details>

https://t.co/B52xTyCNMT

[Cthulhu ( ;,;) @Cthulhu_Answers]

CISA Admin Leaked AWS GovCloud Keys on Github https://t.co/8L1BbCskuR

[Malcat dev @malcat4ever]

We tested 9 LLMs on real-world #malware triage and static unpacking tasks, using only #Malcat’s MCP server.
We compared not only their results, but also their speed and cost.
Full write-up:
https://t.co/z9KN3SR4P4

[Nicolas Krassas @Dinosn]

Another BYOVD process killer. works on all EDR's. fully signed. https://t.co/LGrjf7TnE7

[an0n @an0n_r0]

seems to be hot. a 6-year old LPE what was fixed(?) in 2020 by MS is still (again?) working on Win11 (and Server 2025).

just tried the freshly weaponized PoC by @ChaoticEclipse0. regular user -> SYSTEM works like a charm on an up-to-date Win11. 🎉

https://t.co/MeBwPLJpNT

[Gameel Ali 🤘 @MalGamy12]

🪟 New Windows challenge: JanelaRAT

Reverse a real-world RAT, from the initial dropper down to the final C2.

📦 Installer triage
🔍 17 questions
🧬 Multi-stage unpacking
🔐 Config decryption
🌐 C2 hunting

🔗 https://t.co/kaZ3oPeaBN
💬 https://t.co/ktQHg2ZGi4

By @P4nd3m1cb0y

[DirectoryRanger @DirectoryRanger]

Magnetar. sophisticated shellcode loader framework for Windows 10 64bit, featuring advanced encryption and obfuscation, ETW and AMSI patching, as well as process protection and direct syscalls through tartarus gate for hook evasion
https://t.co/ClLwAN4Glv

[vx-underground @vxunderground]

Another Windows zero day released by Nightmare Eclipse (sort of)

It turns out Microsoft just straight up didn't patch an old CVE from 2020 correctly.

https://t.co/sNWBtTo4at

[Nightmare Eclipse @ChaoticEclipse0]

It's confirmed, CVE-2020-17103 patch is ineffective and the vulnerability still exists,
A weaponized PoC can be found here -
https://t.co/7hnamkLsS1

Tested against fully patched Windows 11 and Server 2025 machines.