Kevin Haubris

As it turns out, local #LLMs have a few opinions about large workflows 🤖 In our latest blog, Senior Research Analyst @kev169 walks through the scaling challenges of local LLMs and the custom #Python library he built to wrangle them. Read it now! hubs.ly/Q04mGfjn0

What started as a basic scanner project evolved into a comprehensive endeavor. In our latest post, Kevin Hubris reflects on XZ Utils backdoor news, exploring detection methods pre and post-upgrades. Read it now! hubs.la/Q02wlR460 #Security #Blog

🚨 Today we're excited to release Ghidrathon, a Ghidra extension that adds modern Python 3 scripting (including Python 3.10) to Ghidra! Blog 👉 mandiant.com/resources/blog… GitHub 👉 github.com/mandiant/Ghidr…

@curi0usJack @Flangvik @_xpn_ @HackingLZ You can stream it, just the stream will be a black screen labeled “REDACTED” lol

@Flangvik @_xpn_ @HackingLZ

The greatest compliment we got the other day was something along the lines of I don’t know anything about your internal C2 not even the name 😂 #MissionAccomplished

Find out how building memory loaders can allow you to simulate BOFs for Linux and Mac using new Cobalt Strikes BOF internal functions in our newest #security #blog hubs.la/Q019vMpC0

@timb_machine @HackingLZ @_xpn_ Only tested on Linux and Mac, but just pushed up a change to get a debug build to run on FreeBSD.

@HackingLZ @_xpn_ Wonder if it will work on other ELFy platforms.

Blog post from Kevin will be out tomorrow but if anyone wanted to poke around before then github.com/trustedsec/ELF…

@HackingLZ Best part is that with this loader the object files (built for linux) run on Linux, mac, and anything else that uses the same calling conventions. :)

Kevin is always cooking up some cool stuff at TS this will be released with a blog in the next couple days.

The research team @TrustedSec is happy to announce we're releasing some of our previously internal bof's. Most of it is using windows API's for primitives that can build up to larger actions. If that interests you see more here github.com/trustedsec/CS-…

My colleague @gijs_h posted an awesome blog on converting BOFs to shellcode, which enables you to use them with other/custom C2s. Shoutout to @TrustedSec for the COFFLoader. medium.com/falconforce/bo… #FalconForce #RedTeam #Shellcode

Join Senior Research Analyst Kevin Haubris in making memories in “COFFLoader: Building your own in-memory loader or how to run BOFs” by following his process breakdown ✨#blog hubs.la/H0G_m730

Join @Carlos_Perez and Christopher Paschen for our next #webinar, "Using #Research to Gain Attack Intelligence," on Wednesday, November 4 at 1pm Eastern. Register now to get a glimpse into some of TrustedSec’s internal, proprietary tooling. hubs.la/H0yF--70

Now hiring: The first leader for the newly formed Cyber Incubator and Economic Development Center at @DakotaState. siouxfalls.business/new-dsu-cyber-…

Cobalt Strike 4.1 allows code to be run in a more #OPSEC friendly manner. Senior Research Analyst Christopher Paschen outlines less obvious restrictions of Beacon Object Files and shares his #workflow to assist anyone tasked with writing in this format! hubs.ly/H0sBKQJ0

@jaredhaight @brysonbort @Carlos_Perez So more of the steps from "I've identified a need for a custom tool" through to "Stable tool developed and ready for use" just using a agent and C2 as an example.

Would a training on best practices on development of implants by people who have written these tool be something you would be intered in? Most dev would be low level in C and some Python.

#TrustedSec is expanding its training with online, public offerings! @HackingDave shares how these instructor-led courses will help further educate our #InformationSecurity community and industry #TrainingTuesday hubs.ly/H0pg8Rl0

@MagisterQuis That, and if it’s in c or c++ the valgrind output, if I see tons of errors or memory leaks I’ll just write it from scratch, easier than fixing.

Everybody has their own little things they look for when reading (and deciding to use) others' code. For me it's error handling. Not making sure functions return an expected value is, to me, an excellent indicator of deeper problems.

Hey @ATTHelp - *PLEASE* consider raising the 100GB data cap on rural workers using wireless LTE hotspots (no fixed wireless here). We could use a break right about now...

Get yourself a job / gig at some point in your career where you have no access to Google - sone facility with no phones or internet allowed or accessible for one reason or another. You will be stretched in ways you didn’t think possible and read man pages you’ve only skimmed.

@JoshPauli lol, come to think about it, it has been a while since I tweeted anything huh

@kev169 glad you've alive! 🤪 I thought you had given up on Twitter!

Check it out, latest blog post on selinux and auditd.