Mike Scutt

Blue team researcher focused on all things DFIR, detection engineering, threat hunting, and data pipelines.

[Mike Scutt @omgAPT]

@divatoz @tieroneforum For now many common hunting focuses (auth, persistence, anomalous identity activity, etc.) should continue to function, mostly due to the lack of capability in local LLMs. They use what they know, standard post-exploit TTPs. Activity will be faster but familiar.

[Mike Scutt @omgAPT]

I am thrilled to finally release my research into the capabilities of local LLMs and their potential for use in offensive research and development. Long read, but an interesting journey!

https://t.co/Y0tf8O8pAM

[Mike Scutt @omgAPT]

@volrant136 @cyb3rops 100% this. Threat intelligence and threat indicators are a venn diagram. Motivation and modus operandi pair well with detections, they do not supplant them.

[Yuval Gordon @YuG0rd]

🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️
Read Here - https://t.co/c969sNjQH0

[Thomas Roccia 🤘 @fr0gger_]

🤓 Over the past 3 years, I have been building and sharing real-world applications of AI for cybersecurity.

I just posted a blog with a recap of my public work and a few personal thoughts at the end. Take a look 👇

https://t.co/Qsozyj67k4

[Orange Tsai 🍊 @orange_8361]

The detailed version of our #WorstFit attack is available now! 🔥
Check it out! 👉 https://t.co/EWlBSgXhpx

cc: @_splitline_

[Nasreddine Bencherchali @nas_bench]

The long awaited LOLRMM is here. All the RMM details in a single location along with detection and DFIR details.

This is a huge milestone in the detection space. ⚡🔥

This project would've never seen the light without the amazing contributions listed 💙

Check it out and start leveraging it today https://t.co/kGVC968CDN

[Simone Margaritelli @evilsocket]

Attacking UNIX Systems via CUPS, Part I

https://t.co/T6SqraB5nh

[The Haag™ @M_haggis]

Day 0 LOLRMM so far:
- StreamLit App done
- YAMLs created for 182 RMMs
- Schema done
- Jinja Template primed.
- @nas_bench slinging code.
- @_josehelps slinging code.
- OTHERS SLINGING CODE.

It's happening. It is happening.

Just a teaser... 😶‍🌫️

[remy🐀 @_mattata]

View State, The unpatchable IIS forever day being actively exploited https://t.co/ymSWp9raYs

[Nasreddine Bencherchali @nas_bench]

Really cool blog and definitely worth a read. Execution decoupling (or as it's called here decorrelating) is still a very powerful way to avoid getting detected.

I also never thought of doing a "ctrl+p" from regedit to print the value, that was a cool trick 🔥

Spent some time looking at logs a couple of things to look in case someone used the same.

- Using EID 307 from Microsoft-Windows-PrintService/Operational. We can see location of printed documents (even the ones saved as pdf). A weak indicator but worth a look (if not expected).

- When saving a PDF via the "Microsoft Print to PDF" from regedit. It will save it with the title "Registry Editor". (Not a very common thing). We can use a Yara rule with the string "/Title (Registry Editor)" to detect instance of the PDF on a host.

[Dirk-jan @_dirkjan]

A few weeks ago I gave a talk at @a41con on how to phish for PRTs and phishing resistant authentication methods 👀. The slides, plus a demo video on how to do this with credential phishing are now on my blog: https://t.co/nTDAepwUXR

[Olaf Hartong @olafhartong]

I love the development the MDE team puts into expanding the telemetry! Our slackbot informed me JA3 / JA3S hashes are now recorded. Pretty cool for hunting and detection engineering!

[ESET Research @ESETresearch]

#Breaking #ESETresearch releases a paper about Ebury, among the most advanced server-side Linux malware, which was deployed to 400,000 servers over the course of 15 years, primarily for financial gain. @marc_etienne_ https://t.co/R5yFdlTjqS 1/8

[John Althouse @4A4133]

@Andrew___Morris @GreyNoiseIO Mass exploitation starts with adversaries scanning the internet for vulnerable services. Why not block at the earliest possible stage in the attack chain?

Read more about JA4T in our blog (just released): https://t.co/WOdDQqKoHr

[TrustedSec @TrustedSec]

For almost a year, invisible password spraying could be performed against any #Azure tenant due to a vulnerability in #MicrosoftGraph. In our latest blog, @nyxgeek walks us through how these attacks could have been carried out. Read it now! https://t.co/MFhwH4vZXy

[Mike Scutt @omgAPT]

@Andrew___Morris It's next to your 10mm socket

[Caitlin Condon @catc0n]

Full @rapid7 analysis of PAN-OS CVE-2024-3400 now available from @stephenfewer and our stellar new research teammate @ChairNectar! Spoiler: It's a two-vuln exploit chain. https://t.co/KT2Xd7vyE5

[The Haag™ @M_haggis]

From the one and only @mvelazco 🧙‍♂️✨. The wizard 🪄 who brought to us:

1️⃣ Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard ❄️🌌 https://t.co/JnyYC4Pe8y

2️⃣ Hunting M365 Invaders: Blue Team's Guide to Initial Access Vectors 🛡️🗺️ - https://t.co/pCNxs7Dtae

Has released msInvader 👾 to help defenders 🛡️ simulate techniques in multiple variations against M365 and Azure ☁️🔒.
Check it out:
https://t.co/vekI5hluSZ

[inversecos @inversecos]

APT Emulation Labs: NOW LIVE 🎉

Solve incidents emulating APT29, APT10 and other threat groups.

$45 per month access to ALL labs:
👀 150+ hours of lab content
👀 Disk forensics + ELK logs
👀 Hints, questions and point system
👀 7 days free trial

Labs are created & designed by industry peers:
@ZephrFish @svch0st @ippsec @DebugPrivilege @HuskyHacksMK @inversecos

Each lab comes
with scoping notes, Windows VM with forensic tools, network diagrams, disk forensics, ELK access and was created from our collective experience working in the field.

👇ACCESS THE LABS HERE 👇
https://t.co/raaUSztKtT