godylockz

Cybersecurity Consultant | RSM US LLP | OSCE3 • CISSP • OSCP | Red Team & Offensive Security Specialist

[godylockz @godylockz]

@techspence Have you seen
https://t.co/xrl9bGmrGA
https://t.co/LG82mV3vNs
https://t.co/TeN7nTJjNs
?

[Matt Zorich @reprise_99]

Lots of discussion lately about cyber security job titles and functions, simplified it for you all

Threat hunter = proactively find bad
Incident responder = reactively find bad
Threat intelligence analyst = attribute bad
SOC analyst = catch your own staff doing bad
Red teamer = be bad
Malware developer = build bad software
Malware analyst = understand bad software
Security architect = draw pictures about theoretical bad
Risk analyst = write words about theoretical bad
Compliance analyst = stop companies being fined when bad happens
Data governance analyst = stop companies being fined when bad happens in Europe
CISO = pray they don't get fired when bad happens

[Adam Chester 🏴‍☠️ @_xpn_]

New blog post is up looking at how LLMs are making local EDR rulesets, YARA rules, and behavioral detections trivial to extract. This post focuses on how simple the harness can be. Buckle up h4xx0rs, the next few months are gonna get interesting! https://t.co/QvzXsPA01F

[Alex Neff @al3x_n3ff]

SPN-less RBCD with NetExec🔥

While classic RBCD requires a computer account, you can use U2U authentication to perform RBCD with a normal user account, if a computer account is not available.

Thanks to @azoxlpf, you can now perform this attack with NetExec as well🚀

[Fady Moheb @N1NJ10_]

Tools like Snaffler are great, but crawling SMB shares creates a telemetry nightmare. You instantly light up the SIEM with :

- 5140 / 5145 (Network Share Access)
- 4656 / 4663 (Object & File Access)

So I built Invoke-WindowsSearch to query the native Windows Search DB (OLE DB) directly via WinRM/RPC, It extracts the targets without touching the actual files, completely bypassing the 4663 and 5145 detection footprint.

Trade-offs: Requires the WSearch service (disabled by default on Server OS) and lacks complex regex capabilities. Know your environment before execution.

#RedTeam #ActiveDirectory #OPSEC #ThreatHunting #PowerShell

[Ananay @ananayarora]

Marcus Hutchins, the guy famous for stopping the WannaCry Ransomware, probably has the best take on Mythos doing vulnerability research

[Steffen Buck @buck_steffen]

@Defte_ Update:
Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements:
https://t.co/g42CHDxQdB
Now Shadow Creds are working again 😀

[Bishop Fox @bishopfox]

New from Bishop Fox: Burp Variables, a Burp Suite extension that automates variable handling.
Define once. Reuse everywhere. No more manual token edits!

[Wiz @wiz_io]

💥 Wiz Research has uncovered a critical Redis vulnerability that's been hiding for 13 years

We found RediShell (CVE-2025-49844): an RCE bug in Redis that affects every version of Redis out there. It's rated CVSS 10 - the highest severity possible.

The vulnerability lets attackers send a malicious Lua script, escape the sandbox, and execute code on the host.

About 330,000 Redis instances are exposed to the internet right now. 60,000 have no authentication. Over 75% of cloud environments are running Redis.

Redis released a patch this weekend and we responsibly disclosed everything upon discovery. Huge thanks to the Redis team for their fast response and collaboration ❤️

If you're running Redis: update immediately.

Our blog has the full technical breakdown and security recommendations >> https://t.co/ymPuRl7DyQ

[godylockz @godylockz]

@rouge_cravate Seems slow, have you checked what nmap version scan does to obtain the time? That's what I use for my time sync.

[godylockz @godylockz]

@mpgn_x64 So where's this pull request?

[Micah Van Deusen @micahvandeusen]

Search 15M+ Microsoft 365 tenants by org name or domain and discover all known domains in the same tenant: https://t.co/QxzqVo4sbf. Legacy methods like Autodiscover/GetFederationInfo no longer work (https://t.co/qoKZCMIIU6).

[godylockz @godylockz]

@RedTeamVillage_ Did the bots get them all? WTF

[godylockz @godylockz]

Just found out a BIG OSINT change that was just applied by Microsoft. You can no longer enumerate one-to-many domain-to-AD tenant. Domain keying will be harder to implement.

https://t.co/pfWph2m7ka

For example, this tool is obsolete: https://t.co/gJLlan6wzF

[Tony @TJ_Null]

Someone made a python version of Evilwinrm and it works well!

Although it is missing a few features like bypassing amsi I would add this into your tools to have:

https://t.co/vmVuOlcjvn

[godylockz @godylockz]

@vxunderground I've been following you for a while! Excited for the giveaway 😃

[godylockz @godylockz]

@elonmusk Tell Amazon to get it in their app...

[godylockz @godylockz]

@RegimentGG @Brparadox @Veteran_TV How do I enter? ✋

[godylockz @godylockz]

@WZStatsGG Garbagio

[I am Jakoby @I_Am_Jakoby]

Last night a cool new method to find defender exclusion paths was brought to my attention by @VakninHai
Give him a follow, his account is GOLD

This is even better than going through the event logs like I showed a few months ago. Malware stored in these locations will NOT trigger defender.
So of course I had to turn it into a powershell one liner under 259 characters.

Want to take a deeper dive?
They have a beautiful write up you can check out here:
https://t.co/SiZW3sZqZU

ABSOLUTE LEGENDS

as always you can copy and paste the code from the ALT text
(change to the folder you want to scan)