kübergeek @kubergeek

Joined June 2016

Tweets

7K
Followers

126
Following

842
Likes

2K

SpecterOps @SpecterOps

2 days ago

Lateral movement getting blocked by traditional methods? @werdhaihai just dropped research on a new lateral movement technique using Windows Installer Custom Action Server, complete with working BOF code. ghst.ly/4pN03PG

1 96 224 12K 136

Panos Gkatziroulis 🦄 @netbiosX

4 days ago

🛠️ Wyrm - A red team post exploitation framework for testing security controls during red team assessments. github.com/0xflux/wyrm

1 37 174 7K 98

Zero Day Engineering @zerodaytraining

7 days ago

Did you know? You can estimate the size of an UAF object from the crash log. Just count the purple bytes in the addressed sequence, and multiply by 8

3 24 197 14K 78

Download Image

R.B.C. @G3tSyst3m

a week ago

Hey all, here's my latest blog post: g3tsyst3m.com/fileless%20tec… We'll get to have some fun coding a custom PE loader that downloads and executes our PE in-memory. We'll also take a stab at sneaking past Defender XDR and Sophos XDR. 😸

5 57 199 13K 107

Dr. Nestori Syynimaa @DrAzureAD

2 weeks ago

Okay folks, the first release of the new #AADInternals OSINT tool requiring authentication is out now: osint.aadinternals.com It is still ugly as hell but should do the trick. To use the tool, you need an Entra ID account with a non-default (.onmicrosoft.com) domain name.

Dr. Nestori Syynimaa @DrAzureAD

2 weeks ago

21 19 297 68K 135

Download Image

9 77 404 40K 300

Download Image

Dirk-jan @_dirkjan

2 weeks ago

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

145 897 3K 437K 1K

Jamie Levy🦉 @gleeda

3 weeks ago

So this was a fun one to investigate! We had a threat actor install our agent, and it gave us some insight into what they do for a "living." 👇 huntress.com/blog/rare-look…

10 40 133 35K 50

Florian Hansemann @CyberWarship

a month ago

''GitHub - 0xflux/Hells-Hollow: Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls'' #infosec #pentest #redteam #blueteam github.com/0xflux/Hells-H…

1 34 103 8K 65

Mehmet Ergene @Cyb3rMonk

2 months ago

🚨 SOC Analysts, Incident Responders, and Detection Engineers, Be careful when using the new SessionId information in Entra ID. Learn why 👇 academy.bluraven.io/blog/hidden-ga… #ThreatHunting #DetectionEngineering #IncidentResponse #DFIR

0 28 119 5K 73

Sean Metcalf @PyroTek3

2 months ago

The Print Spooler service is a default service on Windows Servers and is set to run at startup. There are a number of attacks that are enabled by having the Print Spooler service running on Domain Controllers (ex.: Printer Bug: adsecurity.org/?p=4056) At this point it's best to…

3 37 153 11K 125

Download Image

Bert-Jan 🛡️ @BertJanCyber

2 months ago

Sorry to disturb your weekend. There is a SharePoint 0day actively abused. Do not only focus on the rule of MSRC for hunting, other blogs also share different files and folders in use! Additional info: MSRC: msrc.microsoft.com/blog/2025/07/c… Blog by @eyesecurity_: research.eye.security/sharepoint-und…

1 21 46 9K 47

Dirk-jan @_dirkjan

3 months ago

If you want to know how to bring your own IDP in Entra, and abuse OIDC protocols for persistence, my x33fcon talk is now on YouTube 😀

/ˈziːf-kɒn/ @x33fcon

3 months ago

If you want to know how to bring your own IDP in Entra, and abuse OIDC protocols for persistence, my x33fcon talk is now on YouTube 😀

3 34 117 19K 58

Download Image

3 54 166 12K 83

Sean Metcalf @PyroTek3

3 months ago

Want to detect Kerberoasting with no false positives? Setup a honeypot account for detection following the guidance in this article: hub.trimarcsecurity.com/post/trimarc-r… #ActiveDirectorySecurityTip

2 57 259 18K 233

Mehmet Ergene @Cyb3rMonk

3 months ago

🚨 Detection Engineers, Threat Hunters, and SOC analysts, This is especially for you. academy.bluraven.io/blog/how-netwo… #ThreatHunting #DetectionEngineering

5 44 199 12K 174

The Hacker News @TheHackersNews

3 months ago

🚨 A Ukrainian military phishing campaign just escalated. GIFTEDCROOK malware now steals not just browser data—but sensitive documents, emails, and VPN configs. It hides in fake Excel files, exfiltrates via Telegram, and wipes its tracks. The goal? Targeted intelligence ops.…

1 27 64 17K 22

Download Image

TKYN @TKYNSEC

4 months ago

Windows 11 24H2 broke a popular malware evasion technique! The Lloyd Labs self-deletion method now fails because of NTFS changes, so I spent time with kernel debugging to figure out why and how to fix it. Full technical breakdown: tkyn.dev/2025-6-8-The-N…

7 106 334 36K 217

Alexandre Borges @ale_sp_brazil

7 months ago

To date, I have published 15 articles (1045 pages) with the strict goal of helping the cybersecurity community. ERS (439 pages, so far): [+] ERS 05: exploitreversing.com/2025/03/12/exp… [+] ERS 04: exploitreversing.com/2025/02/04/exp… [+] ERS 03: exploitreversing.com/2025/01/22/exp… [+] ERS 02:…

8 124 443 25K 324

Web Security Academy @WebSecAcademy

7 months ago

✨ The "File Upload Vulnerabilities" Learning Path ✨ In this learning path, you'll explore how simple file upload functions can become a vector for severe attacks. You'll learn how to bypass common defense mechanisms to upload a web shell, enabling full control over a…

0 8 38 3K 11

Download Image

hasherezade @hasherezade

7 months ago

#PEbear (github.com/hasherezade/pe…) is now available via WinGet (learn.microsoft.com/en-us/windows/…)! You can install it easier than ever - just type: `winget install pe-bear` from Powershell.