eitot

Co-Founder & Principal Consultant @ Tier Zero Security (

[Dirk-jan @_dirkjan]

It appears the end is near(er) for the Azure AD Graph API with usage of the API now being blocked in one of my tenants with the AAD PowerShell module client ID. Found this out when trying to demo roadrecon 😬. Time to prioritize merging the MS Graph PR from @Thomasbyrne__

[Claudio Contin @claudiocontin]

I wrote a Beacon Object File (#BOF) to steal MS #Teams application #cookies while running within the Teams process. The cookies allow to impersonate the victim on Teams.

More info: https://t.co/Rh77Bs6SZ5

BOF available at: https://t.co/zJVt0x0ZCq

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

one of many reasons why I’d recommend against granting perms to an LLM for email, contacts, calendar, drive, etc.

to be on the safe side, I wouldn’t even touch email integrations/MCP without a burner account

[Claudio Contin @claudiocontin]

On a recent red team we couldn't dump the browser's cookies via the great cookie-monster BOF (https://t.co/j4XERWEBIu), so we attempted to kill the browser's processes and download the file manually, successfully, which provided us with AWS admin

https://t.co/h7iHbeEMy5

[eitot @eitot8]

@kuriharan surprised it hasn’t been banned under EU AI Act…

[eitot @eitot8]

@MCP_Community

[eitot @eitot8]

I’ve been exploring Model Context Protocol (MCP) and decided to build my own MCP server as a small research project. The MCP server interacts with Elasticsearch and allows Claude LLM to perform threat hunting 🤖

#modelcontextprotocol #AI

https://t.co/PXBubuh6n1

[eitot @eitot8]

@xeraa It definitely does ;)

[Claudio Contin @claudiocontin]

Experimented sending #sysmon events to #copilot to determine #detection capabilities

https://t.co/epMpoN9Gjc

[Claudio Contin @claudiocontin]

Wrote a quick post on researching ways to automate workflows using LLMs https://t.co/AugILa5NKA

[Claudio Contin @claudiocontin]

https://t.co/6EVpgZNE0m
A #Windows local privilege escalation affecting Thermo Fisher Xcalibur software we found on a client engagement.
Thanks to @thermofisher for their excellent communication throughout the disclosure process

[eitot @eitot8]

SYN Spoof Scanner - a light weight python tool to perform SYN port scans, with an option to implement offensive deceptions using spoofed source IPs.

Diverting SOC team’s attention by deliberately triggering IDS alerts with false port scan origins.

https://t.co/OXHtJa38sc

[eitot @eitot8]

Kicking off 2025 with a blog discussing offensive deception tactics using a new tool, SYN Spoof Scanner.

https://t.co/JGDCdPCF8k

[Claudio Contin @claudiocontin]

Following the recent #Windows #DPAPI talk @CHCon_nz we released a post on the recent #Chromium App Bound changes

https://t.co/luv2Vem9kf

[S3cur3Th1sSh1t @ShitSecure]

Need some persistence but don't want to make it super obvious? Calling Get-MpPreference from Powershell will try to load wbemprox.dll via COM.🤪So even a sheduled task calling powershell with this function will trigger your C2 connection.

[eitot @eitot8]

PoC vid on our company LinkedIn page: https://t.co/qTXQ7FFBon

[eitot @eitot8]

Revisiting the MiniFilter abuse techniques to blind EDR.

https://t.co/WWAcTLkp4U

[eitot @eitot8]

🛑 5 Common Windows Settings That Leave Your Organisation Vulnerable 🛑

Apart from ADCS HTTP Enrollment, they are all default settings. That’s probably why we keep seeing similar setup 😬

[Outflank @OutflankNL]

Who’s the real #GrimResource? Spoiler: It’s us! 😏

Here's our latest blog on using MSC files for initial access: https://t.co/aQ0Of11pU8

Fun fact: @elastic’s post on this technique came from a sample caught by a blue team, originally used by a red team through our OST offering.

[Andy Robbins @_wald0]

From Domain User to Global Admin. A real example from a real environment.

We found this path with free and open source BloodHound Community Edition: https://t.co/ze4ZR269xy