Garrett

It's been a few months since I released a few short "Mythic Developer" videos. Before making more, I'd like to first get your feedback on the current ones. Please take a few min and fill this out so I can make sure you get the best content :) specterops.typeform.com/MythicDeveloper

Very proud of our team that built and contributed one of our (many) cybersecurity ranges for this AISI research. We're happy to collaborate with others in the AI eval research space as well. arxiv.org/pdf/2603.11214

new ludus features are sick

@curi0usJack @_xpn_ Are you and claude going to fix that stupid nonetype bug?

Claude casually throwing shade on @_xpn_ 😂

someone reaching out to share they hit an objective from research I worked on or a tool I wrote is one of the best feelings

Ludus 2 (@badsectorlabs), new GOAD lab (@M4yFly), 🍪 hack (@XeEaton), DPAPI + Nemesis (@harmj0y + @tifkin_), iOS exploit kit found (@Mandiant), and more! blog.badsectorlabs.com/last-week-in-s…

@_xpn_ 🤞

Excited for this one!!!

@Defte_ @Sniffler0x1 @XPN There's policy assignments for "unknown" computer objects which would fit your non-domain joined computer I think. I talk about that flow here. specterops.io/blog/2025/07/1….

@Defte_ @Sniffler0x1 @XPN The non-domain joined computer need some way to get ahold of the self-signed certificate that SCCM uses during PXE to get the NAA password otherwise it's not going to be able to complete the enrollment with the MP. Adam covers that here: blog.xpnsec.com/unobfuscating-…

Dumb question. I'm fine-tuning my AD recommendation and work on the NAA SCCM. There's one thing I don't get. Since we need the domain computer password to retrieve the NAA password from the HTTP endpoint, why do we need the NAA account if we already have a computer account ?

@Defte_ @Sniffler0x1 and enhanced http, tldr its all certs github.com/subat0mik/Misc…

@Defte_ @Sniffler0x1 we cover this a bit here github.com/subat0mik/Misc…

@MarcOverIP 🙃

Clarification, top speed drops not to recharge the battery but because there simply isnt any power left in the battery. No battery left means about 400-500bhp less. So they drop in speed. They even have to downshift. On the straight. On full power. This is redicilous.

For those not keeping up with Formula 1 (aka the pinnacle of motorsport): new regulations require 50% of power from electric. But the batteries run out. So the top speed drops from 300->250, just to charge the batteries again. This is shameful and has noting to do with racing 😬

@MarcOverIP Turn 9 is depressing

@curi0usJack @L1NKD34D Turn and burn tooling is crazy. Still wrapping my head around it.

@unsigned_sh0rt @L1NKD34D They were fun before AI. Now it's just insane.

There is no feeling like having a mini Derbycon every Tuesday during TargetedOps team calls. 👀