Jacob Paullus

Senior Red Team Consultant @Mandiant

[Jacob Paullus @psycep_]

@sekurlsa_pw @n00py1 @HackingLZ This should be fixed now

[Jacob Paullus @psycep_]

@0xSterny @sekurlsa_pw This _should_ be accounted for already, I don't have a 2025 DC to test with atm

[Jacob Paullus @psycep_]

@sekurlsa_pw Fixed and pushed to main, should dump all NTDS hashes now, let me know if you run into any more issues with it

[Jacob Paullus @psycep_]

Windows is now supported + an internal -proxy flag

[Jacob Paullus @psycep_]

gopacket is live! Check it out, it is intended to be a full reimplementation of Impacket in Go (it is in beta please send me bug reports) https://t.co/9XjTickbyA

[Jacob Paullus @psycep_]

@_atsika I am almost done adding Windows support and a native proxy flag, the people have spoken

[Jacob Paullus @psycep_]

gopacket is live! Check it out, it is intended to be a full reimplementation of Impacket in Go (it is in beta please send me bug reports) https://t.co/9XjTickbyA

[Jacob Paullus @psycep_]

hey… stop that

[Florian Roth ⚡️ @cyb3rops]

Nice work by the Mandiant team

We took a quick look at the compiled binaries and THOR already detected 9 of the tools via generic rules. We then added coverage for the rest.

[Jacob Paullus @psycep_]

@HolyMoly84103 Please let me know if you run into any issues with this in actual use and I can revisit if needed

[Jacob Paullus @psycep_]

@HolyMoly84103 gopacket's WMI only implements GetObject and ExecMethod, the PutInstance marshalling path from that Impacket issue isn't there. wmipersist calls PutInstance via go-msrpc, and after review, it correctly emits the CIM_FLAG_ARRAY count + heap refs that Impacket missed

[Jacob Paullus @psycep_]

@avtvfh1125 It still needs extensive testing in real environments, but the design intentions were behavior parity with Impacket. This is because I was aiming to recreate the networking library first and used the example tools as building blocks. As the project grows I intend to improve tools

[Jacob Paullus @psycep_]

@HolyMoly84103 I tried to address underlying Impacket bugs during the process, so maybe… can you send me the specific error you are referring to?

[Andrew Oliveau @AndrewOliveau]

🔥🤖Excited to share a new blog I co-authored with @h4wkst3r and @kulinacs - Automating the Operator: Integrating LLMs into Offensive Security

https://t.co/ju7S8aAhKS

We show how LLMs make offensive work more operationally useful, introduce 2 new MCP servers, and an NTLM relaying Gemini extension POC

[Andrew Oliveau @AndrewOliveau]

RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.

Hope you enjoy the blog & tool drop 🤟

https://t.co/ch9WuSP6bm

[Jacob Paullus @psycep_]

@zaviergarza

[Jacob Paullus @psycep_]

The tool is release ready, someone give me motivation to write a blog

[Andrew Oliveau @AndrewOliveau]

Publishing a new blog and tool tomorrow 👀

[Jacob Paullus @psycep_]

Planning a new blog+tool release, stay tuned 👀

[Jacob Paullus @psycep_]

ANOTHA ONE ☝️ check out our latest @Mandiant blog, showcasing the terrifying Browser-in-the-Middle techniques of the modern social engineer https://t.co/X1IPjMBi2d

[Jacob Paullus @psycep_]

@AndrewOliveau