offensive security addict. @falconforceteam co-founder. speed maniac.
Joined March 2010
- Tweets 464
- Following 329
- Followers 389
- Likes 975
29 Photos and videos
JMP RSP retweeted
22 Sep 2023
Sponsor Spotlight | @falconforceteam
We would like to thank FalconForce for being a Silver Sponsor for Deadwood 2023! Check out all about their company and services here: falconforce.nl/?utm_campaign…
6
7
3,169
Having an implant running undetected on an edr protected machine is all cool, but detecting TAs is just ~20% about detecting their implant. Detecting the stuff they do with their implant is what matters way more. Local priv esc, cred dumping, lateral movement, etc. Just saying 🤷♂️
1
3
20
Does anyone have a working .NET core gadget for a deserializing vulnerability with json.net? The documented .NET framework gadgets don’t work in core. #SharingIsCaring
JMP RSP retweeted
17 Jun 2022
It’s #FalconFriday and summer is here! Take a refreshing dive into our newest blog, where we will shed some light on how Certipy and Rebeus work with UnPAC-the-hash and shadowing creds, and how to detect these techniques with our free #Kusto detections.
medium.com/falconforce/falco…
1
9
19
👇👇
4 Mar 2022
I'm exited to announce that our 4-day Advanced Detection Engineering for Windows training has been accepted for @BlackHatEvents in Las Vegas.
This will be an in-person training! Looking forward to see you there!
blackhat.com/us-22/training/…
#DetectionEngineering #Sysmon #MDE #DFIR
1
@Staatsloterij kunnen jullie vertellen waarom jullie mij spam sturen op een e-mailadres wat uitgelekt is bij een hack? Het gaat om mails verstuurd van promotrades. Marketing mails sturen door gelekte emails te kopen is behoorlijk illegaal…🙄
2
1
Does anybody know the max number of APIs you're allowed to use in a CS BOF? I'm apparently hitting a limit, but don't know what the limit is and don't know if the limit is the number of unique APIs or total number of calls to Win32 APIs. Any help and retweet appreciated.
2
1
A while back, I encountered this at the local pet store. It roughly says that the data of anyone buying a sturgeon should be registered and disclosed to dutch intelligence at request. Can someone explain why the (dutch) intelligence is interested in sturgeons? Cc: @AIVD
2
1
JMP RSP retweeted
6 Aug 2021
Happy Friday everybody! This edition of #FalconFriday we focus on detection backup tampering on Azure.
medium.com/falconforce/falco…
#FalconForce #AzureBackup #DetectionEngineering #DFIR
5
9
Stay tuned for the AD CS detection rules. @falconforceteam is currently working hard to write and test reliable detections usable in production environments. Don't forget to checkout the whitepaper by @tifkin_ and @harmj0y, they've done most detection engineering already. THNX
8
JMP RSP retweeted
11 May 2021
CVSS 9.9! The vulnerability we ( @OphirHarpaz) found, CVE-2021-28476 (Hyper-V RCE), was patched today!
Our research, fuzzer and vulnerability details was submitted to @BlackHatEvents and @defcon, there is a lot to look forward to.
msrc.microsoft.com/update-gu…
5
84
284