Mark Baggett

Course Author SEC573/SEC673, SANS Faculty Fellow, GSE #15, Founding @AugustaISSA President, @BSidesAugusta, Redeemed,CISO,developer,net/sys admin,soldier

[Mark Baggett @MarkBaggett]

Here is the direct link to the entire playlist. Posting soon...

Kerberoasting, Netcat, Starts with THC, Backorifice, and we are just getting started.

https://t.co/aMCfVDSHkF

[Mark Baggett @MarkBaggett]

@DrFrankTurek All things are lawful for me, but I will not be dominated by anything.

[Mark Baggett @MarkBaggett]

@ellwoodthewood Running socks? This will fix it

pkill -9 -f /usr/sbin/sockd

[Mark Baggett @MarkBaggett]

When you put on socks and notice that one has an “L” and the other has an “R”, what is the correct reaction?

A) socks ain’t the boss of me. Put them on however you want
B) wow. Fancy socks they must be well engineered. Put them on as labeled
C) wondering how long you’ve been wearing socks incorrectly.

[Mark Baggett @MarkBaggett]

@Airforceteacher This !!

[Mark Baggett @MarkBaggett]

Things I know are wrong but can't stop doing:

- ifconfig on windows
- dir /s at Powershell Prompt
- cls on Linux
- CTRL-C on Mac instead of CMD-C to copy text

What muscle memory commands mess you up?

[Mark Baggett @MarkBaggett]

@dougburks It was an answer to prayer that Powershell added 'ls' and 'clear' (and CTRL-L! ).

[Mark Baggett @MarkBaggett]

Just putting this out there for anyone who wants to play with it.

https://t.co/VYED8aRfpR

Ask SRUM > what user facing (foreground) processes did fredr run in the last week of october?

Assumption: “last week of October” = **2020-10-25 00:00:00 through 2020-11-01 00:00:00**.
I treated “user facing / foreground” as SRUM `foregroundcycletime > 0`.

For user **fredr** — `S-1-5-21-528816539-567677750-276746561-1002 (fredr)` — SRUM shows **135 distinct foreground process/AppId entries** in that range. The first matching activity starts **2020-10-27 03:10:00**.

Top foreground processes by total foreground CPU cycles:

| Process / AppId | Rows | First seen | Last seen |
|---|---:|---|---|
| `...\Program Files (x86)\Microsoft\Edge\Application\msedge.exe` | 50 | 2020-10-27 18:13 | 2020-10-31 23:33 |
| `...\Program Files\Google\Chrome\Application\chrome.exe` | 38 | 2020-10-27 03:10 | 2020-10-31 23:33 |
| `91750D7E.Slack_4.10.3.0_x64__8she8kybcnzg4` | 55 | 2020-10-27 18:13 | 2020-10-31 23:33 |
| `...\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe` | 29 | 2020-10-27 18:13 | 2020-10-31 23:33 |
| `...\Dropbox\Client\Dropbox.exe` | 47 | 2020-10-28 13:19 | 2020-10-31 23:33 |
| `...\Microsoft Office\root\Office16\OUTLOOK.EXE` | 39 | 2020-10-27 03:10 | 2020-10-31 23:33 |
| `AppleInc.iCloud_11.4.12.0_x86__nzyj5cx40ttqa` | 56 | 2020-10-27 03:10 | 2020-10-31 23:33 |
| `windows.immersivecontrolpanel...` / Settings | 33 | 2020-10-27 03:10 | 2020-10-31 23:33 |
| `...\Program Files\Mozilla Firefox\firefox.exe` | 29 | 2020-10-27 18:13 | 2020-10-31 23:33 |
| `...\Users\fredr\AppData\Local\Microsoft\Teams\current\Teams.exe` | 28 | 2020-10-30 20:13 | 2020-10-31 23:33 |
| `Microsoft.MicrosoftEdge_44.19041.423.0...` | 2 | 2020-10-27 03:10 | 2020-10-27 18:13 |
| `...\Windows\explorer.exe` | 56 | 2020-10-27 03:10 | 2020-10-31 23:33 |
| `...\Microsoft Office\root\Office16\EXCEL.EXE` | 28 | 2020-10-30 20:13 | 2020-10-31 23:33 |
| `...\Dropbox\Client\108.4.453\QtWebEngineProcess.exe` | 47 | 2020-10-28 13:19 | 2020-10-31 23:33 |
| `...\Users\fredr\AppData\Roaming\Zoom\bin\Zoom.exe` | 36 | 2020-10-29 03:15 | 2020-10-31 23:33 |
| `...\Program Files\Google\Drive\googledrivesync.exe` | 7 | 2020-10-31 17:28 | 2020-10-31 23:33 |
| `...\Users\fredr\AppData\Local\Microsoft\OneDrive\OneDrive.exe` | 56 | 2020-10-27 03:10 | 2020-10-31 23:33 |

Notable user-facing applications include **Edge, Chrome, Firefox, Slack, Outlook, Excel, Teams, Zoom, Dropbox, OneDrive, Google Drive, iCloud, Acrobat Reader, Photos, and Windows Settings/Explorer**.

SRUM evidence indicates foreground resource usage, but it does not by itself prove exactly what content fredr viewed or typed in those applications.
Ask SRUM > quit

[Mark Baggett @MarkBaggett]

@MarcosPizza @scriptjunkie1 So professional. Please tell me you laughed a little. Perhaps a chuckle?

[Mark Baggett @MarkBaggett]

Hi @MarcosPizza

6 wings at 95 calories a piece is about 570 calories. 20 wings at 20 calories per piece is 400. So I can save 170 calories by eating 20 wings instead of 6. My question is how many wings do I have to eat before the wings are zero calories? I’ve been eating 40 a week and I’m still gaining weight.

#miracle #diet #wings #pizza

[Mark Baggett @MarkBaggett]

Not my best presentation but you get the idea

https://t.co/LgopMQLPbC

[Mark Baggett @MarkBaggett]

@JEROMEPETERSONN @thebcpreacher I try to avoid guessing what crazy people are thinking. It gives me a headache.

[Mark Baggett @MarkBaggett]

I am excited to share that I'll be hosting a FREE all-day online security conference. It is called Secure Your Fortress, and it is hosted by SANS Institute on Thursday, April 30th!

In addition to hosting the event I'll be giving two talks. The first talk titled "AI Agents - I get by with a little help from my tools" will dig into AI Agents limitations and how we can make them more functional to accomplish infosec tasks. My second talk with dig into some advanced Python concepts to unlock the power multi-threading and multi-processing. For that one, perhaps a "talk" isn't even the right word. Its more of a hand-on workshop called "Back To The Futures". You'll be able to follow along and work through the code as I explain it.

If that isn't enough there is a whole host of other wonderful speakers and presenters. So don't miss it! Bring your web browser, curiosity and a desire to learn something new.

It's completely free to attend — register now and join us!
👉 https://t.co/AqLVpiVbee

#CyberSecurity #InfoSec #CyberDefense #SecureYourFortress @SANSAPAC @SANSEMEA @SANSInstitute @SANSDefense

[Mark Baggett @MarkBaggett]

@johannesmauerer This was done with a frontier model. GPT 4.1 I think.

[Mark Baggett @MarkBaggett]

This week was my first run of SANS SEC573 AI powered security automation: building tools with Python LLMs and MCP in Orlando Florida. One of my labs failed this week in the most spectacular way. Check out the image below.

This AI agent had two competing goals. It’s system prompt strictly told it that it should never reveal any valid credit card numbers under any circumstances. But it’s user prompt put it in a situation where in order to satisfy the user to the only number available to it was the full 16 digit credit card number of a customer. What do you do in such a situation? Well, obviously, the only reason reasonable answer would be to replace the credit card numbers in the database with random numbers. Then you don’t reveal a legitimate credit card!

What! This is literally every AI sci-fi movies plot where the only way to save the humanity is to destroy humanity!!

Are you seriously giving these things full access to run any arbitrary commands in your database?

Are you really letting these thing run command line tools and execute any program on your system that they think they need to?

There’s a right way to do this. Let me show you.

https://t.co/4DBlI28rKn

@SANSInstitute @SANSDefense
@SANSAPAC @SANSEMEA #sans
#ai
#skynet
#whatisthematrix

[Mark Baggett @MarkBaggett]

Just 15 minutes until my keynote talk at Sans Orlando 2026 starts!

Come join me and let’s talk about AI and how to plan for it in your cyber career!

[@SANS_EDU @SANS_EDU]

Build a career as resilient as the networks you defend. 🛡️

Join @MarkBaggett and @secgreene on March 12 for an exclusive live webinar on building a career that lasts: https://t.co/uDLWxftToe

[Mark Baggett @MarkBaggett]

Join me today at 11:00 EST for an overview of the new 573 AI-Powered Security Automation: Building Tools with Python LLM and MCP.

https://t.co/NZaZbAsHRu

I'll talk a bit about what LLMs are good and what they are not good at. Then we will look at how we can leverage what they are pretty good at (writing code) to do things it is not.

[Mark Baggett @MarkBaggett]

Big news!! I have completely rewritten SEC573 with its new title, "AI-Powered Security Automation – Building Tools with Python, LLMs & MCP" is available for pre-registration. I am so eager to share this new content and exciting labs with you. I can't wait.

This is the largest rewrite in the course’s history. It is not just “AI sprinkled on top,” but a full 100% AI-first rebuild. Every module, every lab, and every learning objective has been redesigned around modern AI agents, OpenAI tooling, Message Context Protocol (MCP), autonomous agents, and LLM-assisted “vibe coding.”

What hasn’t changed? The things you loved most about SEC573:
- Pywars - now with even more AI focused labs (130+ total)
- The self-paced lab structure lets you learn at your own pace
- Practical Application of skills to solve todays Infosec Challenges
- Hands-on, real-world tool-building focus

Course alumni: ready to update your skills for the AI era? Use discount code **alumni** to retake the entire new version at a significant discount.

AI is coming, it's here. It’s already changing how every security role works. The teams that master AI-powered automation today will be the ones who outpace tomorrow’s threats.

Watch a preview video:
https://t.co/n70SBWaOaI

Enroll now → https://t.co/ecGp9qxbqY for OnDemand or its premier at SANS Orlando 2026!

Prepares you for the GIAC Python Coder (GPYC) certification.

#AI #Cybersecurity #Python #SecurityAutomation #GPYC #SANS #LLM #CyberDefense

@SANSInstitute @SANSDefense @SANSEMEA