Sabitlenmiş Tweet
I just published “Introducing Merlin — A cross-platform post-exploitation HTTP/2 Command & Control Tool” medium.com/p/introducing-…
English
Russel Van Tuyl
2K posts
Russel Van Tuyl
@Ne0nd0g
Hacker, Coder, and Friend
Tennessee, Knoxville Katılım Ocak 2009
1.3K Takip Edilen2.1K Takipçiler
Russel Van Tuyl retweetledi
Veterans bring a mission-first mindset to #cybersecurity leadership.
In a guest column for Federal News Network, @Ne0nd0g shares how military experience builds resilient cyber teams & protects critical govt missions.
Check out the article for more ⤵️ ghst.ly/49rszzb
English
Russel Van Tuyl retweetledi
My SCCM BloodHound OpenGraph collector, ConfigManBearPig, is finally ready to share! It can enumerate all of the relay TAKEOVERs and a few CRED and ELEVATE techniques from Misconfiguration Manager with just a domain account. Let me know what you find! specterops.io/blog/2026/01/1…
English
Russel Van Tuyl retweetledi
With OpenGraph, we hope to empower to community to extend the attack graph however they see fit. However, we have encountered many pitfalls over the past 8+ years that we hope you can avoid. Andy does an awesome job explain how to do just that while showing examples of those very situations for you to learn from!
SpecterOps@SpecterOps
BloodHound OpenGraph makes adding nodes and edges simple, but building effective attack graph models? That's where the real work begins. @_wald0 breaks down the theory, best practices, and requirements you need to know. ghst.ly/44Zv7DJ
English
Nice work!
Antonio Piazza 🇺🇸 | JSON Uniq@antman1P
What I've been working on in my free time. Autonomous AI Red Team (Replicant6) in Action – A Glimpse of What’s Next. Using @elizaOS and #MythicC2 from @its_a_feature_ youtu.be/FgBpcbIgu2w?si… @PalantirTech—check this AI Red Team demo. Solo hacks today, AIP-ready tomorrow? #Cybersecurity #RedTeam #cybersecurity #MCP #RAG #AI @_xpn_
English
Come join us, there isn’t a better place to work and show your technical excellence surrounded by the industry’s best if you ask me!
SpecterOps@SpecterOps
Our Consulting Services team is growing! 🙌 We are now hiring Consultants and Senior Consultants to join the team as operators, trainers, and program developers. Learn more & apply today! ghst.ly/3PBmGFZ
English
Russel Van Tuyl retweetledi
I'm excited to get my latest blog post about purple team efficacy out into the wild! You may feel like the point I'm making is obvious, but I'd argue that a lot of concepts seem obvious only when you're faced with an argument on it's behalf.
posts.specterops.io/to-infinity-an…
English
Russel Van Tuyl retweetledi
My On Detection series is back! In this edition I explore how the same behavior (operation chain) can be implemented using several different execution modalities and the implications of this for detection engineers.
posts.specterops.io/behavior-vs-ex…
English
Russel Van Tuyl retweetledi
👋 Hello, Nashville! If you’re at #WiCyS2024 come by Booth 228 to chat with a few Specters and learn more about us.
English
Fantastic post on the process to find an interesting bug. You can clearly see the team’s passionate curiosity here.
Zach Stein@synzack21
Curious about Intune's new EPM feature? So were we. In this blog @subat0mik and I explore the internals of EPM and share some interesting findings. posts.specterops.io/getting-intune…
English
Russel Van Tuyl retweetledi
Been working to improve my BOF/C dev skills, created some BOFs mimicking SQLRecon modules as a fun learning exercise
github.com/Tw1sm/SQL-BOF
English
Russel Van Tuyl retweetledi
Imposter Syndrome is real, but you can take it multiple ways:
1) Out of any group, there is always something to learn
2) Out of any group, there is knowledge that only you have. Share it!
Be excellent to each other, always be learning, and always share!
English
Amazing thread by @__invictus_ . I also believe that there’s a lot of value in exercising response and think we should be doing this more so organizations are more ready when the inevitable happens.
Tim@__invictus_
There seems to be this idea that red teaming is about improving detection, whilst true in part people seem to ignore incident response. You cant assess IR effectiveness without spreading through a network undetected. Imo assessing IR provides far more value. Some examples...
English
Hermes is finally updated for Mythic 3.0 and it doesn't require the Darling kernel module anymore! This means the Hermes container is _much_ more stable. Read about the update here :D
slyd0g.medium.com/upgrading-herm…
English
Russel Van Tuyl retweetledi
MutationGate is a new approach to bypass EDR's inline hooking by replacing an unhooked NTAPI's SSN with a hooked NTAPI's SSN at run time with hardware breakpoint.
github.com/senzee1984/Mut…
English
@C__Sto saved the day and pointed me towards the windows.NewCallback() function so that I don’t need cgo for the COFF loader. The function must return only 1 uintptr; hoping that doesn’t cause any problems as I implement the Beacon API💪🏽🎉 #NewCallback" target="_blank" rel="nofollow noopener">pkg.go.dev/golang.org/x/s…
English
@C__Sto I did consider reaching out to you specifically to look at using ASM. Not off the table, but want to get things fully functional with cgo before going that route.
English
Finally got a proof of concept COFF & BOF loader working all in Go. There’s still a lot of work to be done though like take arguments, handle more relocation types, and implement the rest of the Beacon functions. Currently works for TrustedSec’s whoami BOF.
English
@jsecurity101 I agree with you, detect the technique, not the tool. Tools leverage different techniques, sometimes unique to that tool.
English
Detection has to move off of brittle C2 detections.
Detect behaviors. I’m sorry but Merlin, Havoc, etc isn’t special. C2s are just containers to execute actions.
Service creation is service creation.
Process injection is process injection.
The list goes on.
Nasreddine Bencherchali@nas_bench
I'm here to remind you that the most underrated and slept on C2 is actually Merlin. Been there for a long time and still have a very low detection rate across the board. You all be underestimating the power of low detections with go based stuff.
English