Shane Jones (@OhmSecurities) header
Shane Jones (@OhmSecurities) profile picture

Shane Jones

@OhmSecurities

Non-Standard human, husband, and grateful father. USAF veteran. I mostly tweet nonsense, and my tweets are attributable only to me, no other entity.

 Austin, TX
ohmsecurityadvisory.com
Joined February 2015
  • Tweets5.8K
  • Following1K
  • Followers595
896Media
Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)Photo by Shane Jones (@OhmSecurities)
Rest in Peace my love. You protected our family, helped my wife and I start our family and will forever be loved and missed. Amaya Jones 05/2014 - 09/2026
Image from Shane Jones (@OhmSecurities)
2
1
11
709
Shane Jones retweeted
Navy Vet (@UNavyVet) profile picture
Navy Vet@UNavyVet16h
Fair winds and following seas, Stan Nelson. We will remember you.
Image from Navy Vet (@UNavyVet)
Readers added context they thought people might want to know
Stan Nelson, a D-Day Navy veteran shown in the image, died Nov. 20 2025 at age 105 and was not the last survivor of the invasion. varsity.startribune.com/stan-nelson-ch… kstp.com/kstp-news/loca… en.wikipedia.org/wiki/John_C._R… mysanfordherald.com/article/2053,l…
304
1,786
92
20,448
366,318
Released TpDirectCallbackHijack, a process injection PoC where you overwrite one function pointer inside an existing thread pool object (TP_IO / TP_ALPC / TP_JOB), post a single completion packet, and the victim's own worker thread dispatches your shellcode. Restore stub puts the pointer back on the way through, so the thread pool keeps working. No remote thread, no Get/SetThreadContext. Pool Party adjacent. Based on @_0xDeku's research. github.com/Maldev-Academy/Tp…
Image from MalDev Academy (@MalDevAcademy)
Image from MalDev Academy (@MalDevAcademy)
2
39
194
6,485
Make your payload "sleep" to look like any real Windows activity. BusyWork is a Rust library that swaps each pause for randomized real work - hashing, file enumeration, registry queries, DNS lookups - drawn from 76 tasks across seven categories with ±30% jitter on every parameter. No two "pauses" produce the same API sequence, and no timing primitives survive in the compiled binary. A post by Daniel (@PatchRequest) Source: patchi.fyi/blog/busywork-sle… #redteam #blueteam
Image from SEKTOR7 Institute (@SEKTOR7net)
6
32
3
200
10,406
Shane Jones retweeted
Andrea P (@decoder_it) profile picture
Andrea P@decoder_itOct 29
The bypass of LDAP Signing Through Reauthentication described in @SpecterOps blog also works with pure Kerberos relay. too ;-)
Image from Andrea P (@decoder_it)
Image from Andrea P (@decoder_it)
2
59
1
233
7,664
Shane Jones retweeted
alexander (@disneyjail) profile picture
alexander@disneyjailOct 29
This is immersion breaking, this has never happened in Miami
DiscussingFilm (@DiscussingFilm) profile pictureDiscussingFilm
@DiscussingFilmOct 29
GTA 6 includes a fully functional bus and train transportation system. Buses have specific routes & times when they are meant to arrive at each stop. (Source: gamesradar.com/edge/gtavi-co…)
Image from DiscussingFilm (@DiscussingFilm)
27
1,538
7
23,799
257,488
Shane Jones retweeted
WIRED (@WIRED) profile picture
WIRED
@WIREDOct 29
Sources tell WIRED that an Accenture employee’s personal Claude agent ran on a DOD network for two months before it was identified and the vulnerability could be patched. buff.ly/nUjCkPs
A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System

A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System

Sources tell WIRED that an Accenture employee’s personal Claude agent ran on a DOD network for two months before it was identified and the vulnerability could be patched.

wired.com
33
183
66
548
195,241
Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In. ridgelinecyber.com/blog/brea…
Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In.

Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In.

Excluding emergency access accounts from Conditional Access doesn't exempt them from Microsoft's mandatory MFA. Check the method, the exclusions and the alert.

ridgelinecyber.com
10
36
2,634
Shane Jones retweeted
Cannibal 🎃 (@Cannibal) profile picture
Cannibal 🎃@CannibalOct 23
This is all just a very aggressive Cybersecurity Awareness Month campaign
14
293
19
2,039
25,972
Shane Jones retweeted
slice (@sliceofheck) profile picture
slice@sliceofheckOct 22
Chest pains are a sign that you’re a good person and that things are going well
87
7,772
299
58,259
730,439
I want one
Polymarket (@Polymarket) profile picturePolymarket
@PolymarketOct 23
JUST IN: Palmer Luckey's genetically modified military dog startup, Warhound, comes out of stealth, aiming to create enhanced canines for the U.S. military.
Image from Polymarket (@Polymarket)
Image from Polymarket (@Polymarket)
Readers added context they thought people might want to know
This is NOT Palmer's company at all, his company Anduril is only supplying the tech for the dogs, and this is a wholly owed Collosal entiity x.com/palmerluckey/s…
65
Shane Jones retweeted
apewood (@apewoodx) profile picture
apewood
@apewoodxOct 22
LinkedIn is gonna go crazy about these cybersecurity attacks when they find out next month
177
1,017
57
18,034
233,796
Shane Jones retweeted
Dirk-jan (@_dirkjan) profile picture
Dirk-jan
@_dirkjanOct 22
Very cool technique to bypass SMB signing, appears to be patched on recent Windows versions.
aas (@aas_s3curity) profile pictureaas@aas_s3curityOct 21
I wrote up a way to defeat enforced SMB signing for relay. It abuses a documented SMB re-authentication behavior. I'm surely missing nuance and prior art. Corrections welcome. Writeup: blackfield.ch/blog/defeating… PoC: github.com/aas-n/reauthx
Defeating enforced SMB signing: a note

Defeating enforced SMB signing: a note

A documented SMB2/3 re-authentication behavior that keeps a reflected authentication working against a signing-required target.

blackfield.ch
1
26
123
7,932
Shane Jones retweeted
Lazy IT Guy (@lazy_IT_guy) profile picture
Lazy IT Guy
@lazy_IT_guyOct 21
Until we get confirmation Jira is safe from the PHP vulnerability, I don’t think anyone should be opening tickets or assigning me work.
42
1,072
61
16,942
261,848
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed! Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
9
99
5
287
19,547
Shane Jones retweeted
NSA Cyber (@NSACyber) profile picture
NSA Cyber
@NSACyberOct 21
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
1,296
10,831
2,842
70,314
12,616,749
Shane Jones retweeted
Nicolas Krassas (@Dinosn) profile picture
Nicolas Krassas
@DinosnOct 20
redteamfortress/killerland: Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you. github.com/redteamfortress/K…
GitHub - redteamfortress/KillerLand: Collection of reversed vulnerable drivers weaponized into...

GitHub - redteamfortress/KillerLand: Collection of reversed vulnerable drivers weaponized into...

Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you. - redteamfortress/KillerLand

github.com
50
195
7,587
SyscallRevenant - a new method of performing clean indirect syscalls. The main component resolves System Service Numbers (SSNs) and syscall instruction addresses dynamically github.com/SilentisVox/Sysca…
GitHub - SilentisVox/SyscallRevenant: Clean Indirect Syscalls with Syscall Tampering.

GitHub - SilentisVox/SyscallRevenant: Clean Indirect Syscalls with Syscall Tampering.

Clean Indirect Syscalls with Syscall Tampering. Contribute to SilentisVox/SyscallRevenant development by creating an account on GitHub.

github.com
34
143
5,913
CloudKeyVaultEvents: Azure Key Vault Logs, Schema and KQL Hunting, by. @BertJanCyber #DFIR kqlquery.com/posts/cloudkeyv…

CloudKeyVaultEvents: Azure Key Vault Logs, Schema and KQL Hunting

Learn how CloudKeyVaultEvents appears in Microsoft Defender Advanced Hunting, how Azure Key Vault events are ingested, which operations are logged, and how to hunt for suspicious secret, key, and...

kqlquery.com
4
11
1,516
Token Theft in Microsoft Entra ID, by @insinuator Part 1: Threat Landscape and Attack Techniques insinuator.net/2026/08/token… Part 2: Continuous Access Evaluation insinuator.net/2026/09/token… Part 3: Token Protection insinuator.net/2026/10/token…
2
35
121
8,380
Absolutely noone wants this shit
Polymarket (@Polymarket) profile picturePolymarket
@PolymarketOct 13
JUST IN: 3D-printed salmon is coming to U.S. supermarkets, produced by Israeli food technology company Steakholder Foods.
1
55
Load more