Karthick V (KV)

Senior Manager, Cyber Defense at Accenture - Tweets are my own.

[cr3ghost @cr3ghost]

Infosec tradecraft just became reusable by AI agents.

SpecterOps just open-sourced:

79 skills.
22 reusable agents.
26 plugin families.

BloodHound. Cobalt Strike. Outflank C2. Ghidra. Binary Ninja. Ghostwriter. Recon. AppSec. Code review. C2 development. Reverse engineering. Adversary simulation. Windows + macOS tradecraft.

And this is NOT just for red teamers.

Vulnerability researchers:
These workflows could accelerate code review, patch analysis, 1-day research and potentially help with 0-day discovery when paired with real research expertise.

Reverse engineers + malware analysts:
Give agents structured workflows, references and tooling instead of starting every investigation from a blank prompt.

Blue teams + detection engineers:
Study the same offensive tradecraft, emulate attacker behavior, build better detections and start asking what telemetry survives increasingly agent-assisted operations.

DFIR + threat intel:
Understand what adversaries may automate next and turn repeatable investigative knowledge into reusable workflows.

Red teamers:
BloodHound attack paths, recon, C2 development, adversary simulation and operator tradecraft are becoming increasingly agent-assisted.

This isn't another collection of AI prompts.

It's practitioner knowledge being turned into reusable, reviewable security workflows.

Potentially useful for everyone from CTF learners and newcomers all the way to malware analysts, reverse engineers, exploit devs, red teams, blue teams and vulnerability researchers.

This is only the beginning.

@SpecterOps Skills:
https://t.co/Cj77Ir3Qlj

@OutflankNL and @kyleavery breakdown:
https://t.co/q5sEaZlp1E

#Infosec #RedTeam #ReverseEngineering

[The DFIR Report @TheDFIRReport]

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

In April, we observed an intrusion that began with a malicious MSI masquerading as Sysinternals RAMMap and ended in domain-wide deployment of The Gentlemen ransomware.

The intrusion featured EtherRAT, Ethereum-based EtherHiding C2 configuration, TryCloudflare tunnels, GoTo Resolve, Rclone exfiltration to Wasabi, and a newer malware framework named TukTuk.

TukTuk stood out for its resilient C2 design, using SaaS and cloud platforms such as ClickHouse and Supabase, with support for Ably, Dropbox, GitHub Issues, direct HTTP, Slack, and Arweave-based dead-drop configuration retrieval.

Detection opportunities included!

➡️ Full report is linked in the replies.

#ThreatIntel #ThreatHunting #DigitalForensics

[Florian Roth ⚡️ @cyb3rops]

Anyone else seeing Microsoft #Defender flagging #DigiCert root certificate registry keys as malware?

We’ve seen reports that Defender signature update from April 30 added a detection called:

Trojan:Win32/Cerdigent.A!dha

In some environments, Defender apparently detected DigiCert Root CA certificate registry entries and removed them from the trust store.

The affected cert hashes mentioned so far:

0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

Example path:

HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

There’s also a Reddit comment suggesting Microsoft has started restoring the certs and that admins can check this via Advanced Hunting in Defender:

DeviceRegistryEvents
| where RegistryKey contains "0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"
or RegistryKey contains "DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"
| where ActionType == "RegistryKeyCreated"
| where Timestamp > datetime(2026-05-03T04:00:00)
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName
| order by Timestamp desc

On an affected device, this can also be checked with:

certutil -store AuthRoot | findstr -i "digicert"

Could become an annoying day for admins if this spreads

https://t.co/VflLyFgssp

[MagicSword @magicswordio]

Qilin’s EDR killer using rwdrv.sys and hlpdrv.sys to nuke endpoint defenses? LOLDrivers has had both covered:

➡️ rwdrv.sys — since May 29, 2025
https://t.co/XXascchY4g

➡️ hlpdrv.sys — since Oct 27, 2025
https://t.co/hEurMKoC8Y

If you’re using the project, you’ve been protected for months. The best time to inventory your drivers was 15 years ago. The second best time is today. Use LOLDrivers to correlate across your driver inventory and get ahead of BYOVD threats before the next campaign drops.

Don’t have a driver inventory or know where to start? MagicSword is here to help.

https://t.co/vrOvB5Ozw6
https://t.co/VAI34BGjYs

[The DFIR Report @TheDFIRReport]

Threat Actors are "Bringing Their Own Forensics"

In a recent ClickFix campaign, we saw threat actors likely related to Interlock Ransomware, running Volatility (https://t.co/Vq0vkvWutb) directly on victim machines.

Commonly a tool for defenders, the TAs are using it to:

[Kostas @Kostastsale]

Today I’m launching Threat Hunting Labs.

Over the years I’ve analyzed many real-world intrusions. One thing became obvious: most training platforms don’t resemble how investigations actually happen.

So I built something different.

Threat Hunting Labs focuses on investigation-driven learning using real telemetry and structured investigative paths.

If you want to get better at investigating breaches, you should practice investigating breaches.

More details here:

https://t.co/cAuuh7sTJN

[Florian Roth ⚡️ @cyb3rops]

Wrote a set of YARA rules to detect the specific web shells dropped during the SharePoint CVE-2025-53770 exploitation.

- Cleartext and compiled variants
- Forensic artefacts in logs and on disk

Hope it helps.

Rules will be available in THOR Lite and THOR Cloud Lite shortly.

https://t.co/v27uvFhtrc

https://t.co/AaMCX5PZMD

#SharePoint #YARA #ThreatDetection #CVE202553770 #THORLite #DFIR

[Unit 42 @Unit42_Intel]

We are observing active global exploitation of critical Microsoft SharePoint vulns CVE-2025-49704 and CVE-2025-49706.

Orgs worldwide are being targeted. Patch immediately. The exploits are real, in-the-wild and pose a serious threat.

IoCs we've seen: https://t.co/Yp3KaWRtCz

[Florian Roth ⚡️ @cyb3rops]

Threat intel analysts produce threat intelligence.
Detection engineers produce detection intelligence.

Big difference.
Gartner doesn’t list the second one yet.

TI is about indicators tied to a known threat.
DI is about rules that catch malicious behavior across threats.

One ages fast.
The other doesn’t.

People will figure out which one actually scales.

[Florian Roth ⚡️ @cyb3rops]

Many are asking about detection rules for CitrixBleed 2 (CVE‑2025‑5777)

There’s very little public information on how the exploitation shows up in logs. If you’ve seen anything useful or spotted indicators buried in reports, feel free to reach out.

This is not like previous RCEs that drop webshells.
Successful exploitation provides direct access to session tokens, bypassing MFA entirely.
No file writes, no shells – just instant access, followed by whatever the attacker brings next.

That’s exactly why detecting the exploitation itself is difficult.
But post-exploitation activity – the moment attackers upload tooling, run internal discovery, or move further – that’s where detection becomes realistic.
And that’s what our rulesets focus on.

We’ve outlined this before in our material on post-exploitation detection:
📄 https://t.co/PblzIxSZGe

If you want to assess Citrix NetScaler systems for signs of compromise – even from older attacks – here’s how to do it using THOR or THOR Lite over SSHFS:
📄 https://t.co/eyUN9rsZIT

Detection doesn’t start at initial access in this case – it starts after.
And we’re not doing too badly, based on what we’ve seen so far.

[JAMESWT @JAMESWT_WT]

#CopyrightViolation #rhadamanthys

Dll sideloading / Samples👇
https://t.co/gcvhrmtcF1

Urls
⛔️t.]ly/TaodueFilm
⛔️mega.]nz/file/fLgACA4Y#SJoWIZoezgYPALTfZBycxxsKU_UMWAtySwsXPuL7T4o

C2
⛔️51.79.188.221:56001
⛔️104.37.172.175:443 :1057

AnyRun 👇
https://t.co/DmSQkFaTi4

[Dark Web Informer @DarkWebInformer]

💡OSINTk.o - Kali Linux based ISO for OSINT investigations

https://t.co/TuG5Ecvgyq

[Sysdig @sysdig]

🚨 Alert: CVE-2024-12084 🚨

A severe heap overflow vulnerability in rsync could lead to remote code execution—affecting 600k+ systems globally.

🔎 Read more details on the Falco detection rule for this CVE, as well as steps for mitigation from Sysdig TRT:https://t.co/aKe5J8bwxx

[Florian Roth ⚡️ @cyb3rops]

How Sigma rules for emerging threats take shape

- Someone noticed CVE-2024-49113 (#LDAPNightmare) could be detected and shared raw logs
- I realized we needed a Sigma rule to fully unlock its potential
- Another person created the rule
- A third refined and prepared it for release

This is just one example of what happens when smart and motivated people collaborate for the community.

LinkedIn
https://t.co/kEAyjWJd4M

PR
https://t.co/0BO4oVGyTd

[Kostas @Kostastsale]

🐧 It’s finally here! 🔍
The Linux EDR Telemetry Project results are live! After months of testing and collaboration, we’re excited to share how well EDR solutions handle Linux visibility.

Thank you to everyone who contributed, shared feedback, and supported the project! Your help made this possible. 🙌

Read the full blog here: 📝👇
https://t.co/S8c1luzZCO
🔗 Linux Results: https://t.co/L7Aq7Ko9NR
🔗 Scores: https://t.co/3WdJC7ASOr

If you want to support the project and help us keep it going, check out 👉 https://t.co/ZDPf7r6idK

[The Haag™ @M_haggis]

🔄 ICYMI: If you're working with Sigma rules, https://t.co/sysPKdLare is the ultimate tool you need in your arsenal! 🌟

💻 Easy-to-use: Intuitive interface for seamless Sigma rule conversions.
🔧 Multiple backends: Fully powered by pySigma for unmatched flexibility.
⚡ Always up-to-date: Stays in sync with the latest from pySigma.
🚀 Quick setup: Run it live or locally—your choice!

Perfect for analysts and hunters optimizing their detection workflows.

Dive in here: https://t.co/sAtVHI9mbI 🔥

[Thomas Roccia 🤘 @fr0gger_]

🤓 I was reading the fascinating report from @Volexity about the Nearest Neighbor Attack presented at @CyberWarCon.

To keep it documented, I created a quick overview to explain how works the attack to complement their blog post 👇 #threatintel #infosec

[Kostas @Kostastsale]

💥EDR-Telemetry Linux results update

We are getting closer to the release now, aiming for it within the next two weeks. So far, we have tested:

❗️Non-EDRs for comparison purposes only:
Sysmon-for-Linux✅
Auditd (config: https://t.co/3RnIg6Btpr) ✅

♦️EDRs
CrowdStrike✅
Elastic✅
SentinelOne (Complete)✅
LimaCharlie✅
Carbon Black✅
FortiEDR✅
Uptycs✅
Qualys✅
MDE✅

The release will include a detailed blog post on all the events we’re looking for and why. It’ll also include the methodology we followed, along with examples.

*PS - We have a Discord channel dedicated to discussing upcoming changes and all things telemetry! To preserve the quality of discussions, access is limited to project contributors, donors, and sponsors.

If you have already contributed to the project, please DM me so I can send you a Discord invite! Thank you to all of our contributors and donors; this couldn’t be done without you ❤️

[Panos Gkatziroulis 🦄 @ipurple]

AV/EDR Lab environment setup references to help in Malware development https://t.co/lUeAefxgJW