
Head of Investigations @InfoGuardAG https://xitter.cf/t.co/A5lnFAu7eX
Joined October 2012
- Tweets2.6K
- Following1.4K
- Followers29.8K
- Likes142
Stephan Berger retweeted
New research: We audited SEPPmail's virtual appliance & found critical issues. Our post covers CVE-2026-2743 (RCE via syslog.conf) & CVE-2026-44128 (Perl injection) that let attackers read all mails or compromise the appliance. -> labs.infoguard.ch/posts/sepp…
Stephan Berger retweeted
Unveiling Ghost-Sender: a widespread and dangerous Microsoft Exchange Online default misconfiguration exposing thousands of targets (incl.F500) to arbitrary mail spoofing.
Read on labs.infoguard.ch/posts/ghos…
Assess yourself ghost-sender.com
🎯#BruCON0x012 Spring Training (22-24 April) is almost here! Want to learn exploit development, evasion techniques for red teams or anti-forensics, check out the program 👇
💡Register before the end of March. Late registration kicks in three weeks before the event, so don’t miss your chance to save your seat and your budget.
👉 Check out the full training lineup and grab your ticket brucon.org/training
Are you an Incident Responders and want to learn about Anti-Forensics (and Anti-Anti-Forensics😀) ? Check out this hands-on course course, giving you a real-world deep dive into attacker's tradecraft across Windows & Linux. Learn how adversaries hide, and how to detect, recover, and counter them using modern forensic techniques and artifacts. More information and registration ➡️brucon.org/training-details/…
Still searching for the perfect Valentine’s gift? 😉
Show your love (for cybersecurity!) with our #BruCON0x12 Spring Training program — featuring Blue💙, Purple💜, and Red 💖Team courses.
To celebrate the season, we’re extending our early-bird registration until Valentine’s Day! 💘 Don’t miss out — check out the full program and sign up ➡️ brucon.org/training
🚀 Ready to up your #cybersecurity game?
Join the #BruCON0x12 Spring Training (Apr 22–24) — a powerful mix of 5 Red, Blue or Purple team courses taught by top experts.
💡 Early bird pricing until Feb 12 — grab your seat!
🔗 brucon.org/training
Stephan Berger retweeted
I recently reviewed a PingCastle report from a customer and noticed the image below. The image indicates that "EVERYONE" has indirect control over most high-privilege groups. Do yourself a favour and run a PingCastle and/or BloodHound every now and then.
Great news to kick off your Monday! 🎉 The #BruCON0x12 Spring Training program (22–24 April) is now open for registration.
Whether you’re into red, blue, or purple teaming, there’s a spot for you in one of our 5 hands-on courses. 🚀 Secure your seat and grab the early-bird pricing by registering before February 13th.
👉 All details and registration here: brucon.org/post/brucon-0x12-…
Stephan Berger retweeted
🎄 Happy Holidays from BruCON! 🎄
We’ve wrapped up the selection of courses for Spring Training 2026 (22-24 April) and are excited to share the program with you soon. Stay tuned for updates! #BruCON0x12
Stephan Berger retweeted
Slides and such for my @BSidesDresden 2025 talk on H4x0ring with /proc
Slides: docs.google.com/presentation…
Such: github.com/magisterquis/ahjt…
Stephan Berger retweeted

SpecterOps@SpecterOps30 Oct 2025
🇺🇸
United StatesConnected via United States App StoreAccount-level information, not a live location or per-post device.
That feeling when your PowerShell syntax error almost deletes Global Admin. 🫠
@FKasler shares a cautionary tale on why you should always read the docs when you are about to issue a “DELETE” operation on any resource in your client’s infrastructure. ghst.ly/3X2bTZ4
Stephan Berger retweeted
Microsoft-Analyzer-Suite v1.7.0 released today! This update includes a new PowerShell script for analyzing Microsoft Service Principal Sign-In Logs.🚀
Check out the changelog for more information. Happy M365/Azure Threat Hunting!
#M365 #Azure #EntraID #BEC #DFIR #Microsoft #Security #CloudIncidentResponse
github.com/LETHAL-FORENSICS/…
Stephan Berger retweeted
#BSidesBerlin Speaker Showcase
@malmoeb will dissect Mythic—a modern macOS attack framework—covering C2 comms, persistence, OPSEC tricks, and detection paths.
Get your tickets here👉 bsides.berlin
@SecurityBSides #RedTeam #macOS
Stephan Berger retweeted
We just released MemProcFS-Analyzer v1.2.0 with various enhancements.
Check out the changelog for more information. Happy Memory Analysis!
#MemProcFS #MemoryAnalysis #DFIR
github.com/LETHAL-FORENSICS/…
Stephan Berger retweeted
We just released Microsoft-Analyzer-Suite v1.5.1. This update includes bug fixes and a new version of RiskyDetections-Analyzer. Check out the changelog for more information. Happy M365/Azure Threat Hunting!
#M365 #Azure #Entra #BEC #CloudIncidentResponse #DFIR #Microsoft #Security
github.com/LETHAL-FORENSICS/…
Stephan Berger retweeted
Microsoft-Analyzer-Suite v1.5.0 is now available!🚀 We improved among other things the Device Code Flow Abuse detections and added support for the detection of suspicious 'UpdateInboxRules' operations (e.g. used by eM Client).
Check out the changelog for more information and don't forget to follow LETHAL FORENSICS on X and LinkedIn. Happy M365 Threat Hunting!
xitter.cf/LETHAL_DFIR
linkedin.com/company/lethal-…
@InvictusIR #M365 #Entra #BEC #CloudIncidentResponse #DFIR #Microsoft #Security
github.com/LETHAL-FORENSICS/…
Stephan Berger retweeted
Could you all take a moment to check that UAL is enabled on your M365 tenant? The IR team will really appreciate it later!
Stephan Berger retweeted
I am reposting my old post as a reminder to regularly check which UserAgents are logging into your tenant. In more recent instances, we have noticed that TAs are using tools with the following as part of their toolkit:
'node-fetch/1.0 (+github.com/bitinn/node-fetch)'
'GuzzleHttp/7'
Stephan Berger retweeted
I just released Microsoft-Analyzer-Suite v1.3.0. UserAgent Blacklist added, ClientInfoString and Mailbox Synchronization detection of eM Client (Traitorware) added, and much more. Happy M365 Threat Hunting! @InvictusIR #M365 #Entra #BEC #DFIR
github.com/evild3ad/Microsof…
Stephan Berger retweeted
Teaser: Microsoft-Analyzer-Suite v1.2.0 will detect the new Device Compliance bypass technique via Microsoft Intune Company Portal
Check out:
labs.jumpsec.com/tokensmith-…
quzara.com/blog/bypass-intun…


















