Andrew Douma

Die-hard #CyberSecurity Pro 🐧 Full-stack penetration testing. Security Architecture and Engineering. Tweets mostly #InfoSec facts.

[Andrew Douma @securitystreak]

https://t.co/PtoCdsXsFH

[Andrew Douma @securitystreak]

Everyone building agentic AI is one malicious PDF away from a security incident. Prompt injection scales with capability. The more tools your LLM has, the bigger the blast radius. https://t.co/kjXTNPifiG

[VirusTotal @virustotal]

Introducing VirusTotal Code Insight: empowering threat analysis with generative AI. This tool is based on Sec-PaLM (LLM) and helps explaining behavior of suspicious scripts. Code Insight is available now for all our users! More details by @bquintero: https://t.co/TjPJxDWu6T

[Jose Enrique Hernandez @_josehelps]

Thread alert! The Splunk Threat Research team (#STRT) has been busy in the past 60 days. Here's a quick rundown of some of our most recent projects:

[Andrew Douma @securitystreak]

Excellent framework for a cybersecurity program

[Australian Signals Directorate @ASDGovAu]

Today we updated the ACSC’s Information Security Manual (ISM), one of our flagship products for CISOs, CIOs and IT professionals. This framework helps organisations manage cyber security risks to protect organisational systems and data. Visit https://t.co/8gzrpgmhQs

[Wojciech Reguła @_r3ggi]

🔊 New blog post: macOS Sandbox Escape vulnerability via Terminal
https://t.co/z7srrcUc03

[Andrew Douma @securitystreak]

#yara ruleset for better detection of bad actors by focusing on identifying specific non current releases of ⁦@HelpSystemsMN⁩ #CobaltStrike https://t.co/eRU2bv2dUC

[Andrew Douma @securitystreak]

Hackers II (1986) was better ;)

[Andrew Douma @securitystreak]

#hackertools mitmproxy

[Maximilian Hils @maximilianhils]

mitmproxy 9 is out! 🎉

https://t.co/GrxJLtQCxE

Three highlights:

[Andrew Douma @securitystreak]

#hackertools Legitimate RATs used by adversaries - #DFIR analysis ⁦@TeamViewer⁩ ⁦@anydesk⁩ ⁦@AteraCloud⁩ ⁦@Splashtop⁩ to proactively block these on network and endpoints if you are not a customer today https://t.co/Q4svOgezCm

[Andrew Douma @securitystreak]

#hackertools Regulator - new approach to subdomain enumeration https://t.co/Z2CX8VmeAO

[Lukasz Olejnik @lukOlejnik]

Memory safety (for cybersecurity) is still a problem. And a long journey, some of it documented here (and what to do about it, and where we are going) https://t.co/uBQbz22zJn

[Stryder @Stryder0301]

@JimSycurity @dildog The last time an auditor asked me why we don't use password rotation like they wanted I replied that we were following current NIST standards and that I was surprised they hadn't updated to current standards yet since the update came out a few years ago.

[Andrew Douma @securitystreak]

Mobile app uses TimeOfFlight sensor to detect hidden cameras better than existing state-of-the-art commercial #hiddencamera detectors (CC308+, K18) #privacy https://t.co/wnD8fL0SBb

[Andrew Douma @securitystreak]

@rheem I received the wrong parts, in an unprotected plastic @FedEx bag, every. single. one. damaged. nice job all around!

[Arris Huijgen @bitsadmin]

Windows Exploit Suggester - Next Generation v1.0 has been released! Including the new missingkbs.vbs utility and an in-depth blog post on how to use it: Windows Security Updates for Hackers. Latest #WESNG release: https://t.co/juCqs7yyyW, blog: https://t.co/BPyzSNZSFR

[Cybersecurity and Infrastructure Security Agency @CISAgov]

In case you missed it --> We released a catalog of known exploited vulnerabilities to reduce the significant cybersecurity risk these vulnerabilities pose. Take a look: https://t.co/nM8nISvmo7 #CVE #Cybersecurity

[Andrew Douma @securitystreak]

Crack WPA2 WiFi passphrase by capturing PMKI roaming hash. Solid write-up sans the outdated guidance on what a "secure" password makes. https://t.co/bERtWrVSGa

[Andrew Douma @securitystreak]

#mindmap for Active Directory penetration tests

[Mayfly @M4yFly]

AD Pentest mindmap upgrade :
Full version: https://t.co/hE0VKO5b2I

xmind version (slow, the map is big) :
https://t.co/D3Dck14tiq

Fell free to tell me what is missing !