Scott Taylor

Senior Red Teamer emulating realistic tactics and techniques || Previously Aplura, MITRE, T. Rowe Price

[Scott Taylor @scottctaylor12]

What checky said 😁 Apply for the Sony Red Team Internship this summer and come work with us!

[One punch mander @checkymander]

My team has an intern position available! US based (hard req), preferably in the VA area (not a hard requirement, just a nice to have if you want to attend some intern events/team events)

https://t.co/Cy1WnSu7Jw

[One punch mander @checkymander]

My team has an intern position available! US based (hard req), preferably in the VA area (not a hard requirement, just a nice to have if you want to attend some intern events/team events)

https://t.co/Cy1WnSu7Jw

[Scott Taylor @scottctaylor12]

If you'd like to read more about this process in depth, checkout my blog post where I talk about external C2, Mythic development, and weaponing GitHub
https://t.co/nHchoCIVL2

[Scott Taylor @scottctaylor12]

Mythic users out there, I wrote a GitHub C2 profile that is compatible with the Athena agent by @checkymander! As always, shoutout to @its_a_feature_ for the framework and great community support. Check out the C2 Profile at:
https://t.co/jboqYHIsV5

[Scott Taylor @scottctaylor12]

@checkymander Bro your tradecraft is next level 🔥

[One punch mander @checkymander]

I'll give you a patchless amsi bypass

[One punch mander @checkymander]

https://t.co/jFYR9ZWlvU

Setting up Nemesis can be daunting, I wrote a blog post detailing the exact steps you need to to go from a fresh Ubuntu 22.04 image to a running Nemesis setup.

Future posts, I'd like to go into operational usage of it with Mythic and other tools

[Cody Thomas @its_a_feature_]

It's official! Mythic 3.0 is LIVE! Check out the blog post about it here: https://t.co/LJb77jLqQZ. Highlights include: rpfwds, graph groupings, jupyter notebook, custom webhooks, tags, docker updates, and an entirely new back end!

[Scott Taylor @scottctaylor12]

@M_haggis When's the official drop time? I'm F5ing over here like it's ShmooCon 😁

[Scott Taylor @scottctaylor12]

@Flangvik Rust isn't in my future until it works with Donut! Curse you thread local storage....

[Scott Taylor @scottctaylor12]

@checkymander *our

[Scott Taylor @scottctaylor12]

@checkymander Bro quit leaking out internal tools!

[Scott Taylor @scottctaylor12]

@Tyl0us Oh wait... You wrote a shellcode loader, not an implant. Forget what I said, Rust is great lol

[Scott Taylor @scottctaylor12]

@Tyl0us If only you could convert it to shellcode with Donut 😢

[Scott Taylor @scottctaylor12]

@passthehashbrwn @vysecurity @chetdorn but x10

[Scott Taylor @scottctaylor12]

@jaredcatkinson @jamieantisocial @HackingLZ The more you know! I typically test my tooling with Sysmon because it's free, but I'll look into MDE

[Scott Taylor @scottctaylor12]

@jaredcatkinson @jamieantisocial @HackingLZ Haha apologies for the scare. Behavior based detection for the win!

[Scott Taylor @scottctaylor12]

@jaredcatkinson @jamieantisocial @HackingLZ However, some orgs rely on their AV to to come with signatures to detect every tool under the sun. Unfortunately that's a never ending game of wackamole between the "superficial wrappers" of new tools and just outright obfuscating existing tools.

[Scott Taylor @scottctaylor12]

@jaredcatkinson @jamieantisocial @HackingLZ Sorry I'm sarcastically shitposting lol. I'm a HUGE fan of tuning Sysmon Event ID 10 to detect LSASS credential dumping. That's one of my favorite go-to examples when explaining detecting TECHNIQUES rather than the procedure (tool) 🙂

[Scott Taylor @scottctaylor12]

@jamieantisocial @jaredcatkinson @HackingLZ In my head I was thinking string-matching signatures leveraging AMSI for visibility, but 'signatures' can be interpreted in ALL sorts of ways lol