brmk

56 posts

brmk banner
brmk

brmk

@_brmkit

just another wannabe redteamer.

Italy Katılım Kasım 2019
437 Takip Edilen15 Takipçiler
brmk
brmk@_brmkit·
During some free time I ended up doing some research on something I never really thought about before: using Windows toast notifications for user manipulation. I ended up writing a BOF and a blog post about it, hope it's useful! brmk.me/2026/03/18/toa…
English
0
6
12
712
brmk retweetledi
dreadnode
dreadnode@dreadnode·
We fine-tuned an 8B model to pop a GOAD domain…using only synthetic training data. No real networks. No frontier model distillation. Just a world model that simulates AD environments and generates realistic pentesting trajectories. See how @shncldwll and @0xdab0 did it: dreadnode.io/blog/worlds-a-…
dreadnode tweet media
English
3
70
257
52.1K
Tim
Tim@__invictus_·
Currently working on what could be the most impactful code I've ever written. It's not an 0day, a new IA technique, or some fancy malware. Nope. It's an automated note taking app integrating the new Nighthawk API with outline. Complete fucking game changer.
English
5
0
22
1.7K
brmk retweetledi
Bad Sector Labs
Bad Sector Labs@badsectorlabs·
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectsid ENDS WITH '-516' WITH COLLECT(c1[.]name) AS dcs MATCH (c2:Computer) WHERE c2.enabled = true AND (c2.operatingsystem contains '2025') AND (c2[.]name IN dcs) RETURN c2[.]name If this query hits, you're in.
Yuval Gordon@YuG0rd

🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️ Read Here - akamai.com/blog/security-…

English
3
73
267
22.6K
brmk retweetledi
Johannes Bückler
Johannes Bückler@JohannesBuckler·
Gli sperperi di denaro pubblico post terremoto dell’Irpinia sono ormai entrati nella storia di questo Paese. Una brutta storia, riassunta in dieci volumi presentati al Parlamento il 5 febbraio 1991 e inviati a varie procure da una commissione d’inchiesta presieduta da Scalfaro.
Johannes Bückler tweet media
Italiano
23
185
724
63.4K
brmk retweetledi
Andrea P
Andrea P@decoder_it·
OK, I promise to stop spamming about relays with NTLM/Kerberos 😅. But if you're a member of the Distributed COM or Performance Log group, these juicy CLSIDs let you trigger remotely machine authentication of any computer, including DCs, and relay DCOM -> HTTP, SMB… 👇
English
8
74
270
31.9K
brmk retweetledi
Michael Coppola
Michael Coppola@mncoppola·
New blog post "Google: Stop Burning Counterterrorism Operations" My reflection on an incident where Project Zero and TAG knowingly shut down an active Western counterterrorism cyber operation, and the real-world harm that could have resulted from it. poppopret.org/2024/06/24/goo…
English
64
130
541
479.9K
brmk retweetledi
Chetan Nayak (Brute Ratel C4 Author)
Watching people tweet they bypassed a certain EDR is just cringe at this point. When you ask them what did they bypass, they dont know what. So let me take you back to school... Executing OpenSource tool is not a bypass. An EDR employs several mechanisms for detection. Getting a new implant for a twitter image is not evasion. To have a proper bypass, several conditions must be met. Lets see... 1. When you say you bypassed an EDR, what did you pass? Initial connection? Post-ex? Userland unhooking of DLLs? DLL callbacks? Exception handlers? Kernel hooks? Userland ETW or Kernel ETW? Yaras? If you didnt test any of this, how do you know that you bypassed it. 2. I know EDRs which simply allow connection and monitor it to gather more intel on threats, but will kill the implant upon interaction with local env. 3. The implant must be executed in the form of an initial access like an actual RT/TA would do. 4. All EDR functionalities must be enabled including internet for ML anomalies 5. Did you interact with the implant after getting a shell? Most EDRs will kill you on the moment of interaction with local files or processes due to call-stack scanning. 6. Does your implant leave "shouting traces" of "I exist" in memory which can be traced with a simple process monitor with a memory dump? Most importantly, have you ever reversed the EDR or its modules to understand what exactly is happening in the back end? Do you even know "WHAT" is actually being detected by the EDR? On the other hand, I just woke up and I guess I chose voilence today. So time to go back to sleep 😂.
English
15
110
470
56K
brmk retweetledi
Rob Fuller
Rob Fuller@mubix·
Intern, Junior, Senior, Principal, Sr Principal, Staff, Master, Artisan. These are the levels I believe best suites most of the fields of study in Cyber Security. I worked with @carnal0wnage to put some of this together one day and wanted to share my thoughts on it:
English
7
18
154
26.7K
brmk retweetledi
Grzegorz Tworek
Grzegorz Tworek@0gtweet·
Kerberos tickets dumping in pure PowerShell 😍 I simply love such approach. So much more beautiful than loading pre-compiled binary blob. And so much harder to detect... linkedin.com/posts/mzhmo_hi…
English
3
194
560
46.6K
brmk
brmk@_brmkit·
@tryhackme What did the ransomware attacker ask for on Christmas? A byte of good will! #ChatGPT
English
0
1
0
0
TryHackMe
TryHackMe@tryhackme·
Another day, another giveaway - sleigh, what?! With #AdventOfCyber well and truly under way, we’re giving away extra tickets to the big pool of prizes! You just need to reply with your favourite Christmas joke 🎄 Entries close on Sunday 18th December. Good luck! 🤞
TryHackMe tweet media
English
794
145
1.1K
0
Nathan McNulty
Nathan McNulty@NathanMcNulty·
Renaming local admin is pretty useless My usual guidance is to randomize the built-in admin account password using New-Guid, disable it, and create a new local admin with the password managed by LAPS :) LAPS group policy allows us to define a non-default admin to manage ;)
Mick Douglas 🇺🇦🌻@bettersafetynet

Bad blue tips: "Change the local administrator name so attackers get confused" Lets kill this bad advice! Please spread this info in this thread instead. No matter what you name your local admin account it will always be RID 500. Many attack tools go after the RID directly. 1

English
11
21
112
0
Marius Hauken
Marius Hauken@mhauken·
Shortcuts is the most powerful app on your iPhone. But 99% don’t know how to use it. Here are 7 shortcuts to make your life easier:
English
288
2.8K
18.7K
0
Ahsan Khan
Ahsan Khan@hunter0x7·
IDOR Checklist
Ahsan Khan tweet media
English
118
909
3K
0
Marko Denic
Marko Denic@denicmarko·
If you're looking for a remote job, open this:
English
1.1K
18.6K
82.5K
0