v1n @0xv1nx0

detection engineer 🦝 v1n.sh Joined March 2023

Tweets

144
Followers

368
Following

134
Likes

87

v1n @0xv1nx0

a week ago

Is posting about your "new" "edr killer" the next "i made a c2" ? 🤔

0 0 1 64 0

The year is almost 2026. We're still letting users double click JavaScript files in enterprise environments. 2027 is the year, I feel it. I definitely won't copy paste this post a year from now, no way.

0 0 1 82 0

Download Gif

Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid

a month ago

I know a lot of people will hate me for saying this but it has to be said. I get a lot of DMs saying RT is getting harder everyday, traditional loaders dont work anymore, opensource tools tend to crash or get detected instantly. But wasnt that the whole point of Red team? Thats…

23 57 377 33K 82

Rasta Mouse @_RastaMouse

2 months ago

Hard to tell because I was pretty dumb to begin with.

Girl loves coding 👩‍💻 @girllovescoding

2 months ago

Hard to tell because I was pretty dumb to begin with.

70 2 93 10K 5

4 1 37 4K 0

v1n @0xv1nx0

2 months ago

recent events make you wonder. at this point are you safer just not having an enterprise firewall vs using one?🤔 ha ha jk, this is satire... unless?

1 0 2 109 0

Rasta Mouse @_RastaMouse

4 months ago

I'm particularly proud to bring PPP pricing into cybersecurity.

Zero-Point Security @_ZeroPointSec

4 months ago

I'm particularly proud to bring PPP pricing into cybersecurity.

11 71 319 42K 76

19 20 256 19K 22

v1n @0xv1nx0

6 months ago

"Pet Friendly" apartment starter kit: - 400 dollar non-refundable pet fee - 250 dollar pet deposit - 50 dollar a month pet rent - 2 Pet limit, and can't have <arbitrary breed list> - no dog park - no walkable areas

2 0 1 168 0

v1n @0xv1nx0

7 months ago

Anyone got that giant iceberg of alternatives to whoami? I'd like to submit this one for Mac - system_profiler SPSoftwareDataType | grep "User Name" | awk -F': ' '{print $2}'

0 0 1 97 0

v1n @0xv1nx0

7 months ago

Lua Lua Lua

1 0 1 186 0

v1n @0xv1nx0

8 months ago

I don't have a C2 tier list, but this one would be in my S-tier: github.com/0x-Apollyon/Ma…

0 0 2 130 0

Fred HK @fr3dhk

9 months ago

Indtroducing: What is this stealer? A new repository that allows for you to identify Stealer malware by the system information text file format commonly included in stealer malware exfiltration. We encourage everyone to check it out and contribute! github.com/MalBeacon/what…

7 139 461 37K 288

v1n @0xv1nx0

a year ago

My first "net new" LOLbin contribution for MacOS! github.com/infosecB/LOOBi…

0 3 7 745 3

v1n @0xv1nx0

a year ago

Wrote a blog on my experience replicating the LOLBin qwinsta using undocumented APIs, really an expansion of work done years ago by @harmj0y but using WinStation instead of Terminal Services. 0xv1n.github.io/posts/sessione…

1 47 153 9K 62

v1n @0xv1nx0

a year ago

Why run "hostname" on macOS when you can just run "nvram -xp | xmllint --xpath "string(//key[.='fmm-computer-name']/following-sibling::data[1])" - | base64 --decode | tr -d ' '"

1 1 5 855 1

bakki @avx128

2 years ago

POC for the silly shenanigans i talk about in my last blogpost can be found here github.com/xrombar/flower now working on a version that doesn't rely on NtContinue, as I now have an "agnostic" IOC for such chains; on top of implementing different ways to "flow" :)

bakki @avx128

2 years ago

19 72 161 53K 91

0 12 36 5K 8

v1n @0xv1nx0

2 years ago

Not sure if it's new or interesting but when Discord launches, it tries to execute `C:\Program Files\NVIDIA Corporation\\NVSMI\nvidia-smi.exe`. Would be a shame to hijack that non-existent bin if user's have Discord set to launch on Windows startup.