Ring3API 🇺🇦 @ntlmrelay

#ThreatHunting / #BlueTeam engineer. I'm just looking for traces in the logs. Reading and retweeting cool stuff. MITRE ATT&CK Defender:CTI,SOCAsses,AE,PTM,THDE. x.com Ukraine Joined October 2011

Tweets

15K
Followers

7K
Following

3K
Likes

11K

volatility @volatility

a day ago

.@volatility New Release: #volatility3 v2.26.2 - visit github.com/volatilityfoun… for details and downloads. #memoryforensics #dfir

3 67 302 20K 111

Download Image

☠️ Brandon @mez0

a day ago

1/2 Over the past few weeks I've used the EMBER2024 model to try and figure out how to make implants less likely to be hit by ML. I wrote about the process here: mez0.cc/posts/evaluati…

3 20 38 5K 29

Ripgrep is slow. Nowgrep is fast, because I bypass the Windows slop and go straight to NTFS. Here's Ripgrep vs. Nowgrep searching through 300k files on a drive with 2M+. Nowgrep is written from scratch in C99. No borrow checker.

153 198 3K 254K 1K

Download Video

Pew @TheGrandPew

3 days ago

GET /pwn.html hmmm

DARKNAVY @DarkNavyOrg

3 days ago

GET /pwn.html hmmm

23 225 969 194K 462

Download Video

1 10 164 24K 76

SEKTOR7 Institute @SEKTOR7net

2 days ago

Diving deep into Windows hypervisor. A great post by r0keb (@r0keb) on Hyper-V loader, partitions, startup and other details, combined with lots of rev-engineered C code. Worth reading! Source: r0keb.github.io/posts/Hyper-V-… #redteam #maldev #malwaredevelopment

0 57 230 11K 140

Download Image

codewhisperer84 @codewhisperer84

5 days ago

Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM. github.com/trustedsec/Tit…

13 187 532 83K 230

allthingsida @allthingsida

2 weeks ago

Build IDA Pro 9.2 addons (plugins, stand-alone apps, processor modules or file loaders) the easy way with IDA SDK + ida-cmake + Claude Code. Full walkthrough video: youtu.be/Wi06U3w9-w4

3 26 123 18K 65

Squiblydoo @SquiblydooBlog

2 weeks ago

"FUD" from VirusTotal. Signed, 112 MB file. Lets analyze. File is SingleFile .NET; I see this with Malcat: Debug and Exports indicate it is SingleFile (green arrows in image) Also, Malcat carved 270 PE out of the overlay (blue arrow), indicative of SingleFile .NET 1/8

MalwareHunterTeam @malwrhunterteam

2 weeks ago

3 1 11 11K 2

Download Image

2 20 50 9K 21

Download Image

Tom Dörr @tom_doerr

a week ago

Real-time network monitoring, connection tracking, and deep packet inspection in your terminal

4 125 979 51K 923

Download Image

J⩜⃝mie Williams @jamieantisocial

a week ago

i have 🅽🅾 clue how someone found this. github.com/phith0n/collis…

22 139 2K 194K 1K

Download Image

Print3M @Print3M_

2 weeks ago

ByteCaster 🔥 – my new tool for payload encryption, obfuscation, and conversion to byte arrays. github.com/Print3M/ByteCa… - 14 output formats: C, Rust, C#, Nim, Go... - AES-256, RC4, XOR supported - IPv4Fuscation, MACFuscation, base64/32 #malware #redteam #security #infosec

6 68 352 15K 213

Download Image

Stephan Berger @malmoeb

2 weeks ago

XWorm, as described in the latest HP Wolf Security report [1], goes to great lengths to evade security products. .chm file, VBScript, PowerShell, batch file, JavaScript, PowerShell, Steganography (the data from the image is used to reflectively load a .NET assembly).. 😮‍💨 But…

2 24 65 7K 37

Download Image

Mehmet Ergene @Cyb3rMonk

2 weeks ago

🚨Detect Actor Token Abuse (#CVE-2025-55241) After verifying the details with @_dirkjan, I created a query to detect Actor Token abuse, regardless of the activity involved. The idea is simple: If these activities are S2S, they should originate from Microsoft service IPs. 🧐…

4 64 289 21K 174

Download Image

Dirk-jan @_dirkjan

2 weeks ago

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

145 897 3K 436K 1K

Anton @Antonlovesdnb

2 weeks ago

FREE lab ( deployed via Ludus ) --> github.com/Antonlovesdnb/… ConDef Lite ( Lab & Course Materials ) --> justhacking.com/course/condef-… Constructing Defense 2025 ( Cloud-hosted lab & Course Materials ) --> justhacking.com/course/constru…

1 7 12 2K 18

@zephrfish.yxz.red @ZephrFish

3 weeks ago

Here's an initial release of a LDAP browser written in python with a nice GUI and some integrations with #BloodHound github.com/ZephrFish/pyLD…

@zephrfish.yxz.red @ZephrFish

3 weeks ago

Here's an initial release of a LDAP browser written in python with a nice GUI and some integrations with #BloodHound github.com/ZephrFish/pyLD…

3 9 67 30K 32

Download Image

5 44 211 18K 132

Two Seven One Three @TwoSevenOneT

3 weeks ago

#redteam Now, you can dump the #Windows password from the LSASS process with help from the past: WerFaultSecure.exe Github: 2x7EQ13/WSASS Experimental version: Windows 11 24H2 #Blueteam

13 148 621 45K 479

Download Image

TrustedSec @TrustedSec

3 weeks ago

Even with HTTPS, Windows Server Update Services can be abused if attackers obtain a trusted certificate, allowing authentication relay. In our blog, @Coontzy1 explains how WSUS traffic can be found and abused, and what sparked his investigation. Read now! trustedsec.com/blog/wsus-is-s…

3 94 250 17K 139

Elastic @elastic

3 weeks ago

Cross-Cluster search with ES|QL is now GA! Query data across multiple clusters with a single, elegant query. Learn more: go.es.io/3Kcts5w #ElasticSearchLabs