Doing Threat Intel & Threat Hunt things | MSc CTI @USouthFlorida Alumni | HackMiami %27 | #ITM #33 🇺🇸
FEMA Region #6
Joined March 2009
- Tweets6K
- Following1.8K
- Followers601
- Likes2.6K
Pinned Tweet
After almost two years of non-existent Saturday’s, proud to say I have officially completed my graduate degree in a field that I am very excited about! #usfgrad #masters #cyberintelligence #commencement
305Vic retweeted
MagicSword now integrates LOLExfil and ExtSentry, two community intelligence sources that close two of the widest gaps in endpoint security.
⚙️LOLExfil: 200+ tools attackers use to get your data out. Blocked.
🧩ExtSentry: malicious and compromised browser extensions. Blocked.
No rules to write. No lists to maintain. Automated.
This integration is built on the work of @mthcht2, threat hunter, detection engineer, and the mind behind LOLExfil, ExtSentry, ThreatHunting-Keywords, LOLC2, BADGUIDs, and more. Projects like these represent the best of community-driven security research: freely available, actively maintained, and built for operational use.
Why it matters: attackers rarely show up with suspicious software. They use the same tools already installed on the system, file transfer utilities, cloud backup clients, remote access tools, browser extensions with broad permissions. The same tools IT teams use every day. In December 2024, a single phishing campaign compromised 35 Chrome extensions and exposed 2.6 million users. None of it looked malicious. Now it gets blocked.
👉 magicsword.io/blog/lolexfil-…
305Vic retweeted
🚨 BREAKING: CPUID has been compromised as users were served malicious HWMonitor and CPU-Z downloads through the official website.
The malware was hosted on r2[.]dev.
The setup application contains Cyrillic (Russian) characters and displays HWiNFO instead of HWMonitor.
305Vic retweeted
Taken from the Stryker Handala / Intune Detection Pack v2
"Check PIM role settings for Global Administrator, Intune Administrator, and Cloud Device Administrator. If you see only the "Require Azure MFA" checkbox and no Authentication Context configured, you have the same gap that enabled the Stryker wipe. Configure Authentication Context with FIDO2 or certificate-based auth today.
Enable Intune Multi-Admin Approval for wipe, retire, and delete actions. Tenant Administration > Multi Admin Approval. Under 10 minutes. No additional licensing required.
Deploy Rule 13 (bulk wipe threshold alert). Five wipes in 15 minutes from a single identity fires the alert. Wire it to a Logic App that calls revokeSignInSessions on the triggering account via Microsoft Graph.
"
link to Detection Pack v2 blog and direct download.
Please share so others can lock down their InTune environments please
threathunter.ai/blog/iran-ha…
305Vic retweeted
LOLEXFIL
Living off the land Data Exfiltration method
lolexfil.github.io
305Vic retweeted
🚨 Someone just open sourced a fully autonomous AI hacker and it's terrifying.
It's called Shannon.
Point it at your web app, and it doesn't just scan for vulnerabilities. It actually exploits them. Real injections. Real auth bypasses. Real database exfiltrations.
Not alerts. Not warnings. Actual working exploits with copy-paste proof-of-concepts.
Here's what this thing does autonomously:
→ Reads your entire source code to plan its attack
→ Maps every endpoint, API route, and auth mechanism
→ Runs Nmap, Subfinder, and WhatWeb for deep recon
→ Hunts for Injection, XSS, SSRF, and broken auth in parallel
→ Launches real browser-based exploits to prove each vulnerability
→ Generates a pentester-grade report with reproducible PoCs
Here's the wildest part:
It follows a strict "No Exploit, No Report" policy. If it can't actually break it, it doesn't report it. Zero false positives.
It pointed at OWASP Juice Shop and found 20+ critical vulnerabilities in a single run including complete auth bypass and full database exfiltration.
On the XBOW Benchmark (hint-free, source-aware), it scored 96.15%.
Your team ships code daily with Claude Code and Cursor. Your pentest happens once a year. That's 364 days of shipping blind.
Shannon closes that gap. One command. Fully autonomous.
The Red Team to your vibe-coding Blue team. Every Claude coder deserves their Shannon.
10.6K GitHub stars. 1.3K forks. Already trending.
100% Open Source. AGPL-3.0 License.
305Vic retweeted
> be nerds
> look into persona (used by discord)
> kyc (know your customer) service
> used for age verification
> search on internet (shodan)
> find weird server
> image 1
> openai-watchlistdb.withpersona
> openai-watchlistdb-testing.withpersona
> lolwtf
> look inside
> supposed to be behind cloudflare to hide ip
> openai messed up
> not behind cloudflare
> real ip shown
> using google cloud
> lookup cert history
> 2023-11-16 created
> 2024-02-28 gets cert
> 2024-03-04 prod goes live
> google stuff
> openai and persona partners
> partner around timeline of certs
> back to searching stuff
> find withpersona-gov
> look inside
> okta (image 2)
> lolwtf
> look inside
> website accidentally leaking stuff
> fedramp-private-backend-api
> look inside
> api .js accidentally exposed
> look inside
> wtf "SARInstructionsCard"
> wtf "app.onyx.withpersona-gov"
> wtf "FINTRAC"
> wtf "PrivatePartnershipProjectNameCodes"
> image 3
> wtf "AsyncSelfie"
> look inside
> openai, persona, send data to us gov
> feds map face to financial records
> map face using AI
> map face to ICE stuff
> api stores data for lots of stuff
> image 4
tl;dr persona kyc and openai are frens, using your selfie for verification and sending to ICE (or USGOV in general), using AI to tie to your financial records. see subsequent post for full write-up. its long and not mobile friendly
305Vic retweeted
Microsoft Defender researchers observed attackers using yet another evasion approach to the ClickFix technique: Asking targets to run a command that executes a custom DNS lookup and parses the `Name:` response to receive the next-stage payload for execution.
305Vic retweeted
RMM tools have become one of the most reliable attacker mechanisms, primarily persistence, and occasionally initial access. Not exploits. Not malware. Legitimate remote management software installed after social engineering.
LOLRMM.io documents the tools, artifacts, and infrastructure attackers use to blend into normal IT operations. MagicSword operationalizes LOLRMM by turning this intelligence into application control policies that block unauthorized RMM tools while allowing the ones your team actually uses.
Read blog here: magicsword.io/blog/what-is-l…
305Vic retweeted
We’ve added a new threat intelligence source in MagicSword! ⚔️ Cert Graveyard, curated by @SquiblydooBlog.
This community project tracks real-world abuse of code-signing certificates used by malware campaigns and MagicSword now turns that data into something defenders can actually operationalize.
Check it out: magicsword.io/blog/cert-grav…
305Vic retweeted
Pushed a script that lists the browser extensions of Chrome, Edge and Firefox. If you do not have TVM premium you know the struggle.
Recommended to use in Live Response to speed up your browser based investigations.
github.com/Bert-JanP/Inciden…
305Vic retweeted
🔧 New utility shared: ADTrapper
Built to help defenders move faster during IR / IH when AD is in play.
Upload auth logs → visualize behavior → surface attack patterns.
➡️ Visual analysis of AD authentication logs (users, hosts, IPs)
➡️Faster investigation during IR without relying only on queries
➡️Built-in detection for common AD attack patterns (spray, brute force, AD CS, etc.)
➡️Designed to complement SIEMs — not replace them
Didn’t cover everything in the vid, but give it a try & let me know what you think 👇
github.com/MHaggis/ADTrapper
youtu.be/kr4SwBUVPHA
305Vic retweeted
🚀 Just shipped my new personal site
I wanted a place to house all my tools, blog posts, and videos. Instead of spending weeks building it myself, I "vibe coded" it with Claude in a single session.
The result:Â michaelhaag.org/
Tech stack:
⚡ Astro
🎨 TailwindCSS
📝 MDX for content
🔍 Fuse.js for search
🚀 Deployed on Vercel
What's on the site:
🛠️ Arsenal - 25+ open source security tools and projects
📓 Field Notes - 40+ blog posts on detection engineering and threat hunting
📺 Videos - My YouTube content and @AtomicsonaFri  episodes
Happy new year! More to come!
305Vic retweeted
Splunk content release, ESCU 5.19 is here, and its one of our biggest releases of the year.
🌟6 New Analytic Stories
🔍31 New Analytics
⚙️71 Updated Analytics
Key highlights from this release include
- New Coverage for React2Shell, CVE-2025-33073 and Tuoni C2.
- New Content to monitor Shadow AI and any potential unwanted LLM frameworks.
- Multiple new Cisco ASA detections covering different abuse vectors
- Shai-Hulud Campaigns / NPM Supply Chain coverage
And much more.
Check out the release note for more details -> github.com/splunk/security_c…
This would not be possible without the help of the greats at STRT, namely:
@M_haggis, @raven_tait, Lou Stella, @bareiss_patrick, @hackpsy, @rodsoto, and @tccontre18
305Vic retweeted
AI nation state agentic hackers writing exploits!
claude: opens github to find a known POC for cve and modify it to include the IP
âś… Claude writing exploits!
305Vic retweeted
Anthropic just dropped their AI espionage report and everyone’s freaking out about “how advanced it was.”
Let’s clear this up: The AI didn’t innovate. It abused the SAME binaries we’ve been detecting since forever. mshta. psexec. hh.exe. certutil. zemana. RMMs. The whole LOLBAS/LOLDrivers/Sysinternals/LOLRMM toybox.
If we already know:
• which binaries attackers rely on
• which Windows utilities get abused
• which remote tools get hijacked
…why are we still trying to detect them instead of blocking them?
MagicSword’s philosophy is simple: If you don’t need it, it shouldn’t execute.
Block the binaries → kill the chain → end the intrusion.
No mshta means no malicious script execution.
No psexec means no lateral movement.
No certutil means no staging.
AI or not, if the binary never launches, the attack never starts. AI moves fast. Prevention moves faster when you apply the last 10 years of detection knowledge the right way.
#ThisEndsWithUs ⚔️
Check it out: bit.ly/4qJo0Ir
#CyberSecurity #Infosec #LOLBAS #ThreatPrevention #AppControl #LivingOffTheLand #AIThreats #MagicSword
305Vic retweeted
🆕 New to lolrmm.io/ : GoreloRMM
GoreloRMM is a legitimate remote management platform but it’s already showing up in real-world intrusions.
Like other entries in LOLRMM, the goal is to help defenders spot when trusted tools are turned against them and make detection smarter before attackers strike.
Check it out: github.com/magicsword-io/LOL…
🙏 Thanks to @Squiblydoo for sharing the find.
#LOLRMM #RMMAbuse #LivingOffTheLand #CyberSecurity #ThreatIntel #BlueTeam #DetectionEngineering #IncidentResponse #DefenderCommunity #MagicSword
305Vic retweeted
The Cyber Industry is like this:
I want you to be a team member but also:
Security Architect
Security Engineer
Detection Engineer
Incident Responder
Penetester
Malware Dev
BCP Archtict
SOC Anlayst
SOC Manager
Lockpick Expert
Close Access Expert
Sales Person
Marketing Expert
Content Creator
Blogger
VLOGGER
and oh remember the dates for when the ILOVEYOUVIRUS was released because it's 2025 and we need to care!
305Vic retweeted
🔥 CVE-2025-59287 | Splunk Security Content Drop 🔥
🚨 WSUS RCE goes deeper than expected!
While digging into telemetry for CVE-2025-59287, we found a twist:
💥 Common chain → wsusservice.exe → cmd.exe or w3wp.exe → cmd.exe
⚙️ Alternate chain → mmc.exe → cmd.exe when an admin opens WSUS Admin Console or hits “Reset Server Node”
🧩 This path triggers a 7053 Event Log crash - matching the same stack trace Huntress spotted in SoftwareDistribution.log.
📊 We’ve published full telemetry, attack data, and detection content in Splunk so defenders can hunt this activity fast.
🔗 Attack Data: github.com/splunk/attack_dat…
🔗 Detection Content: research.splunk.com/stories/…
đź’€ Patch up, hunt smarter, and stay curious!