L1inear

Security Evangelist | Note Taker Extraordinaire | Red Team | Ex-Professional Certificate Grinder

[L1inear @l1inear]

@Jean_Maes_1994 @OpenAI @AnthropicAI @thsottiaux Would love to know the process a bit more. The application seems different and we’ve never gotten a response.

[L1inear @l1inear]

@Cyb3rMonk Many people shared similar criticisms of the EDR telemetry project, especially folks that know what they are talking about. Similar responses, so this tracks very well.

[L1inear @l1inear]

@forefy A lot of our clients ask us whether or not macos is more secure than windows. The EDR space is much more mature on Windows that if something like this was fired on Windows environments, its unlikely to work. MacOs different story.

[🕳 @sekurlsa_pw]

Quick 'n dirty BloodHound ecosystem overview. The different ingestors, collectors, analysis tools.
There might be things missing.
https://t.co/w9UI3Rii7d

[Avid @Av1dlive]

this is f**king dangerous

someone just figured out how to get fable 5 reasoning in opus 4.8 with one prompt

you have less than 24 hours to set this up as this takes away 20% of your usage limit

here is how:

1) Paste the prompt and ask it to "make an operating manual"
2) Create a New Claude Project and "Add this .md in Project instructions
3) Use Opus 4.8 High/Max and now you have Fable 5 reasoning at 1/5th the price

save and bookmark it no matter what

[L1inear @l1inear]

@ipurple If you remove the syscall part, you'd still get by Windows Defender.

[darkzodchi @zodchiii]

Anthropic engineer:

"You can build 5 assistants in one afternoon. Each one handles a task you've been doing manually every single day."

In 45 minutes he builds 5 focused agents from scratch on camera.

Most people are still doing code review, testing, and documentation by hand every single day

Watch the session, then save all templates below 👇

[Co11ateral @co11ateral]

BYOVD and Looting LSASS in the Modern EDR Era

Uncovering the internals of kernel driver vulnerabilities and leveraging them via the BYOVD method. Using kernel access to disable PPL for the LSASS process and then dumping the process to disk, XOR’ing it beforehand so it avoids detection by popular EDR solutions.

Was released yesterday, so be careful

https://t.co/SmDvpK8uC1

#apt #redteam #blueteam

[Fady Moheb @N1NJ10_]

Tools like Snaffler are great, but crawling SMB shares creates a telemetry nightmare. You instantly light up the SIEM with :

- 5140 / 5145 (Network Share Access)
- 4656 / 4663 (Object & File Access)

So I built Invoke-WindowsSearch to query the native Windows Search DB (OLE DB) directly via WinRM/RPC, It extracts the targets without touching the actual files, completely bypassing the 4663 and 5145 detection footprint.

Trade-offs: Requires the WSearch service (disabled by default on Server OS) and lacks complex regex capabilities. Know your environment before execution.

#RedTeam #ActiveDirectory #OPSEC #ThreatHunting #PowerShell

[L1inear @l1inear]

@logangraham @AnthropicAI Would it be possible for smaller players that are authorized to perform offensive work to secure our clients to access Mythos?

[L1inear @l1inear]

@whokilleddb Jealous! Let me know if you ever are in and around the Canada infosec event/space.

[shenetworks @shenetworks]

After not receiving a raise in the four years I’ve worked at BHIS they’ve now decided to reduce my pay by $40k after coming back from maternity leave and moving my role to solely pentesting. So I am looking for a new position effective immediately if anyone has any leads 😇

[Ananay @ananayarora]

Marcus Hutchins, the guy famous for stopping the WannaCry Ransomware, probably has the best take on Mythos doing vulnerability research

[impulsive @weezerOSINT]

https://t.co/MAePsbT9Id
found a 21KB kernel driver from 2004 built for windows xp that still loads on windows 11 ASTRA64.sys by EnTech Taiwan. signed in 2006, cert expired in 2007, but its timestamped so windows still says "signature verified" 19 years later. the company doesnt exist anymore.

31 IOCTLs with zero validation on anything. arbitrary physmem R/W, port I/O, PCI config R/W, MSR read, interrupt hooking, keyboard injection. no auth gate, no hardware gate, loads on any system with sc.exe not on loldrivers. not on hvci blocklist. no CVE. vendor is dead so you cant even do responsible disclosure. theres nobody to email

filed an issue @M_haggis

[Muhammad Ayan @socialwithaayan]

🚨 BREAKING: Someone just built the exact tool Andrej Karpathy said someone should build.

48 hours after Karpathy posted his LLM Knowledge Bases workflow, this showed up on GitHub.

It's called Graphify. One command. Any folder. Full knowledge graph.

Point it at any folder. Run /graphify inside Claude Code. Walk away.

Here is what comes out the other side:

-> A navigable knowledge graph of everything in that folder
-> An Obsidian vault with backlinked articles
-> A wiki that starts at index. md and maps every concept cluster
-> Plain English Q&A over your entire codebase or research folder

You can ask it things like:

"What calls this function?"
"What connects these two concepts?"
"What are the most important nodes in this project?"

No vector database. No setup. No config files.

The token efficiency number is what got me:

71.5x fewer tokens per query compared to reading raw files.

That is not a small improvement. That is a completely different paradigm for how AI agents reason over large codebases.

What it supports:

-> Code in 13 programming languages
-> PDFs
-> Images via Claude Vision
-> Markdown files

Install in one line:

pip install graphify && graphify install

Then type /graphify in Claude Code and point it at anything.

Karpathy asked. Someone delivered in 48 hours.

That is the pace of 2026.

Open Source. Free.

[Rony @Ronycoder]

Instead of watching an hour of Netflix, watch this 2-hour Stanford lecture on AI careers. It will teach you more about winning in the AI race than all the AI content you’ve scrolled past this year.

[L1inear @l1inear]

@ShitSecure @HackingLZ Been wanting to do this too! Planning to release publicly?

[L1inear @l1inear]

@domchell This isn’t even a pentest, this is a scan.