I have been recruited by the Star League to defend the Frontier against Xur and the Ko-dan Armada
Joined July 2009
- Tweets1.5K
- Following405
- Followers1.3K
- Likes1.7K
William Metcalf retweeted
10 years ago today CAPE Sandbox was released...
Today we are proud to announce its desktop partner-project CAPEsolo: github.com/CAPESandbox/CAPEs… 🎉
All the power of the sandbox in a desktop application 💪
pip install capesolo
William Metcalf retweeted
I just pushed out version 1.9.28 of box-js to NPM (npmjs.com/package/box-js).
Nice! Yeah there is also signify which tries to approximate the ms-cert store pypi.org/project/signify/. Worth a look you! I wanted something that I could deploy in win sandboxes/throw away server core workers that did real validation using win api's. think updated signtool.
@SquiblydooBlog This tool is probably only useful to me.. But hat tip to you :) and certgraveyard.. github.com/wmetcalf/myatg
I was also recently looking into this for keys pulled out of lsass/SSLKEYLOG for cape runs. I found a PAN writeup from years ago that claimed this was possible with tshark but couldn’t get to work so I recently baked it into my HAR/SaZ conversion tool github.com/wmetcalf/GoGoRobo…
William Metcalf retweeted
Security Detections MCP 3.0 is LIVE
What started as a detection search MCP is now an autonomous detection engineering pipeline.
Agents now run a full workflow:
CTI → coverage analysis → detection generation → SIEM validation → PR staging
Pipeline example:
• CTI Analyst → extracts MITRE techniques from threat intel
• Coverage Analyzer → checks 7k+ detections across Sigma / Splunk / KQL / Elastic
• Detection Engineer → generates missing detections
• Atomic Executor + SIEM Validator → tests detections
• PR Stager → prepares them for review
Multi-SIEM support:
Splunk • Sentinel • Elastic • Sigma
Open source 👇
Repo
github.com/MHaggis/Security-…
npm
npmjs.com/package/security-d…
Pulse MCP listing
pulsemcp.com/servers/mhaggis…
Watch the full demo:
youtu.be/03ZmD5cdfHI
