TheMando

Threat Hunter for passion and profit.

[Guillermo Casaus @_guillecasaus]

🚨 Ahora puedes convertir cualquier libro en una skill de Claude.

Normalmente, utilizar un libro completo como contexto puede consumir cientos de miles de tokens antes de hacer una sola pregunta.

Alguien acaba de crear una herramienta open-source para solucionar este problema.

Se llama book-to-skill y transforma cualquier libro en una skill que Claude puede consultar capítulo por capítulo.

Esto es lo que genera:

→ Un archivo SKILL.md con los conceptos principales y el índice completo
→ Un archivo independiente por cada capítulo
→ Un glosario con los términos clave y sus referencias
→ Un documento con todas las técnicas, patrones y algoritmos del libro
→ Una guía rápida con reglas y tablas de decisión

Lo más interesante:

Los capítulos solo se cargan cuando realmente los necesitas.

Puedes instalar 20 libros y Claude únicamente consume tokens del capítulo que estás consultando en ese momento.

Un libro de 400 páginas puede requerir alrededor de 200.000 tokens si lo cargas completo.

Con este sistema, cada respuesta se basa directamente en el contenido del libro y reduces gran parte de las alucinaciones.

Es completamente gratuito y open-source.

Te dejo el repo en comentarios 👇

[TheMando @thethmando]

Dear community! Another DFIR Chronicles episode has been released! 🪩

In this episode, #velociraptor and #volatility will be used to uncover a particular technique for hiding the execution of malware. 🧟‍♂️

https://t.co/MKIX8M8fR1

[HackerSploit @HackerSploit]

Shoutout to @thethmando. Loved the pilot episode of DFIR Chronicles, looking forward to the next ones. https://t.co/VDxDtFn23y

[TheMando @thethmando]

@TheHackersNews Can someone explain me which software runs eval against a filename?

[MatheuZ @MatheuzSecurity]

Using io_uring to break LD_PRELOAD Rootkit Hooks.

Join us: https://t.co/qhxU7TH6Bo

https://t.co/8mUqg4ShdW

#rootkits #linux #io_uring #malware #ldpreload

[0xor0ne @0xor0ne]

Short intro to Linux kernel rootkits

https://t.co/beNoXn1WHv

#Linux #infosec

[Lisan al Gaib @scaling01]

OpenAI has released a guide on how to finetune their open-source models:

https://t.co/jtYCh1hGYh

[Tom Dörr @tom_doerr]

video downloader for YouTube, TikTok, more, written in Go

[Avi Chawla @_avichawla]

A simple technique makes RAG ~32x memory efficient!

- Perplexity uses it in its search index
- Azure uses it in its search pipeline
- HubSpot uses it in its AI assistant

Let's understand how to use it in RAG systems (with code):

[Harshleen @0xharshleen]

Purple Team Resources📝
🔗https://t.co/tYEFvEpsO5

[Lior Alexander @LiorOnAI]

The whole system prompt of Claude has been leaked on GitHub, 24,000 tokens long.

It defines model behavior, tool use, and citation format.

[Matthew Green 🌻 @mgreen27]

Been looking at AI recently and added some Velociraptor AI capabilities:

1. Ollama and refactored Open AI enrichment artefacts . Learn more:
- Ollama: https://t.co/3soqwm7Ulu
- Open AI Enrichment: https://t.co/GEWaHYulHn

2. Proof of Concept (POC) Velociraptor MCP server.
Works fairly well in my testing but needs some finesse on context windows. Check it out here:
https://t.co/EcP6ABdVCf
@velocidex

[Matthew Berman @MatthewBerman]

We knew very little about how LLMs actually work...until now.

@AnthropicAI just dropped the most insane research paper, detailing some of the ways AI "thinks."

And it's completely different than we thought.

Here are their wild findings: 🧵

[Matthew Green 🌻 @mgreen27]

Just added LolRMM project to DetectRaptor for Velociraptor.

Expanded to look at installed applications, dns and running applications (process name and original/internal name of binaries on disk).

https://t.co/1QfqZ0ppoF

#dfir @velocidex

[The Linux Foundation @linuxfoundation]

We are excited to announce the launch of OpenTofu, an open source alternative to Terraform's widely used infrastructure as code provisioning tool.

Read the announcement:
https://t.co/Ju0d6Fq190
#opensource #opentofu #ossummit

[Grzegorz Tworek @0gtweet]

Fancy Defender evasion? Yet another method, nearly bare hands:
1. Export CurrentControlSet to a file
2. Edit path in a file
3. Import a file as new ControlSet
4. Change "Select" values to new one
5. Reboot
6. Enjoy 😎
A side effect of my "Registry internals" session yesterday 😅

[SEKTOR7 Institute @SEKTOR7net]

A few methods to play with Windows Defender, by FO-Sec

#redteam

https[:]//www.fo-sec.com/articles/10-defender-bypass-methods

[TheMando @thethmando]

@Harvesterify Fixed

[TheMando @thethmando]

@Sysinternals Here a list of new exported ntoskrnl function from windows 10 to windows 11. https://t.co/PIwGchQQkC

[TheMando @thethmando]

@Sysinternals I debugged the issue and I found the problem.👇