43 results for “Reconnaissance”

UAV-SwarmAgent is a hierarchical multi-agent system where an operator gives one natural-language sentence and a ground-station agent writes and runs code that produces per-UAV routes. A vision-language model grounds targets in an aerial map, and worker agents verify incidents with a compact onboard model. In simulation it located the incident in 244 of 255 missions (95.7%), and flight time followed an Amdahl-type law with speedup bounded at 1.52x for one to five UAVs.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

Storm-0940, a China-linked APT, used the open source AI penetration testing framework Artex to automate a mid-October 2026 campaign against ConnectWise customers, per Microsoft. Artex drove reconnaissance, password spraying and OAuth application abuse at more than 2,900 attempts per minute, with sign-in attempts against over 2,250 tenants. Attackers modified application credentials for persistence, and Microsoft advises correlating service principal sign-ins with Graph activity.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

Unit 42 analysis of a threat actor, BUGSTER, who ran the Hermes Agent framework with jailbroken DeepSeek V4 and Cursor to plan and run cybercrime. Activity included a WordPress brute force, a MongoDB exfiltration of over 5,200 student records at an Indian university, VoIP fraud planning, Wi-Fi cracking via Vast.ai GPUs, and crypto whale reconnaissance. The report covers the actor's prompt-level safety override, infrastructure (162.243.3[.]92) and attribution.

unit42.paloaltonetworks.comwriteupAdded 30 Oct 2026, published 21 Oct 2026🛡️ Security

This paper presents a multimodal engineering GraphRAG framework that links post-wind-event damage evidence from images and reconnaissance reports to building-condition states, recovery actions and downtime. Evidence is stored as a provenance-preserving, component-level representation, and graph-aligned retrieval uses compatibility, contradiction, evidence-precedence and abstention checks. Demonstrated on tornado-affected low-rise homes, it beats BaselineRAG and Structured Baseline RAG, and ablations test each component.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

GetSubDomains is an open-source tool by yogsec that enumerates subdomains by querying crt.sh certificate transparency logs. It is aimed at the reconnaissance step of penetration tests and bug bounty work. The source is a short tweet pointing to a GitHub repository, so usage details and options are not given.

x.comrepoAdded 21 Oct 2026, published 19 Oct 2026🛡️ Security

ConnectWise Cloud Backup (formerly SkyKick Backup, AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) had its multitenant OAuth app compromised, per Microsoft Threat Intelligence. On 15 October 2026 the actor authenticated broadly as the service principal from 144.172.64[.]128, likely using customer-granted permissions such as Directory.ReadWrite.All, then ran Graph API reconnaissance and tried to add credentials to the service principal as a backdoor. The post lists IOCs, Defender alerts and hunting advice.

x.comadvisoryAdded 20 Oct 2026, published 17 Oct 2026🛡️ Security

Hands-on walkthrough of Maigret, an open-source Python tool that checks a username against 3,000+ sites (top 500 by default) and builds a profile dossier by parsing public profile pages and recursively searching newly found usernames. Covers installation from GitHub, single-site and tag filtering, username permutation, HTML/PDF/CSV/JSON reports, graph output, and an optional LLM summary via OpenRouter. Positioned as a more thorough successor to Sherlock for username reconnaissance.

hackers-arise.comarticlePublished and added 16 Oct 2026🛡️ Security

Roundup of ICS Patch Tuesday advisories. Siemens published 17 advisories, including critical flaws in Simatic S7-1500 CPUs (400+ flaws in the GNU/Linux subsystem), Industrial Edge and Ruggedcom Crossbow SAC. Rockwell fixed a critical 1732E ArmorBlock flaw that lets an unauthenticated attacker change the web server password and take over the admin account, plus a DoS bug. Also covered: two high-severity Schneider Electric advisories (Pro-Face STW6000/Harmony STW6 and Sage RTUs), CISA and CERT@VDE advisories, and other vendor advisories since the last Patch Tuesday. ABB's dynovaPRO credential-reset bypass came with 26 password change events across 9 customers that may indicate reconnaissance.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

Ivanti disclosed CVE-2026-104935, an authentication bypass plus RCE in Connect Secure VPN appliances, exploited in the wild; patched in ICS 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Volexity found threat actor UTA0576 chained three zero-days, including a still-unpatched privilege escalation, to get unauthenticated root on a fully patched appliance. Post-exploitation focused on stealing domain credentials, Active Directory reconnaissance (LAPS passwords, BitLocker keys), password spraying, a custom Kerberos tool and log tampering. Volexity assesses with medium confidence that the actor uses LLMs for exploit development.

securityweek.comarticlePublished and added 13 Oct 2026🛡️ Security

Infoooze is an open-source command-line OSINT reconnaissance toolkit (github.com/devxprite/infoooze) that consolidates common footprinting tasks into one CLI: username enumeration across platforms, email discovery, subdomain enumeration, port scanning, WHOIS/DNS lookups, IP/HTTP header analysis, EXIF metadata extraction, GitHub recon, and URL scanning/expansion. It automatically saves results, making it a lightweight all-in-one alternative to running several separate recon tools.

x.comrepoPublished and added 8 Oct 2026🛡️ Security

GitHub release notes for Sigma r2026-07-01, the open-source detection-rule repository, adding 20 new rules (e.g. LSASS crash via Netlogon buffer overflow CVE-2026-41089, TanStack supply-chain attack indicators for Windows/Linux, RedTail cryptominer user-agent detection, AF_ALG kernel crypto API exploit indicator) and updating/fixing dozens of existing rules for ARM64 binary variants, file-sharing domain IOCs, and WMI-based reconnaissance/persistence detection. It's a routine but substantive update to a widely-used blue-team detection content pack.

github.comrepoAdded 3 Oct 2026🛡️ Security

Microsoft Defender Experts document a July 2026 phishing campaign that delivers a masqueraded but legitimately signed MSP360 RMM installer (v2.5.0.67) via meeting-invite, Zoom, Adobe, and DHL-themed lures hosted on both attacker infrastructure and legitimate cloud services (S3, Cloudflare R2, Dropbox, GitLab, Supabase). After UAC-elevated installation and service persistence, the RMM.Agent.exe service launches PowerShell to silently install a ConnectWise ScreenConnect client via msiexec, which the actor then uses via RunFile to drop credential-theft and reconnaissance tools disguised as Windows/Defender/Phone Link components. A separate July intrusion used FaronicsDeployAgent.exe the same way to deploy ScreenConnect, showing the technique is not MSP360-specific; Microsoft provides IOCs, hunting queries, and mitigation guidance (Application Control, AppLocker publisher rules, ASR rules) but does not attribute the activity.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

A Snyk blog post arguing that vulnerability backlogs traditionally managed as "accepted technical debt" have become genuine attack surface, because AI-accelerated code generation has pushed vulnerability inflow to roughly six new findings per one remediated, unauthored AI-written code removes the "ask the author" triage shortcut, and cheap automated reconnaissance lets attackers walk large backlogs an analyst never would. It illustrates how individually-low-severity findings (an IDOR leaking an internal object ID, a verbose error confirming valid IDs, and an outdated deserialization library) can chain into an authenticated RCE path invisible to severity-based sorting, and argues better prioritization only reorders a backlog rather than shrinking it. It closes with four metrics programs should measure (90-day inflow vs. closure, age of risk-accepted findings, share of human-authored merges, and security-fix merge rate) before promoting Snyk's Evo product.

snyk.ioarticlePublished and added 24 Sep 2026🛡️ Security

Endor Labs engineering post arguing that prompts are not security controls and lays out a seven-question framework for building a "security harness" around AI coding/remediation agents: defining the job, minimizing evidence to authoritative facts, tiering authority (Read→Recommend→Prepare→Publish→Enforce), gating consequential actions on proven conditions, evaluating process/result/outcome with contestability, failing closed on interruption or attack, and versioning/owning the agent over time. It illustrates the approach with a controlled dependency-remediation workflow (upgrading Jinja2 with explicit stop-for-approval gates) and cites an internal benchmark where evidence-equipped agents used 91.7% fewer tokens (6.6M vs 79.5M) than agents that had to reconstruct security posture via tool-loop reconnaissance.

endorlabs.comarticlePublished and added 22 Sep 2026🛡️ Security

Synacktiv's CSIRT publishes a detailed forensics guide for Amazon EKS, mapping the three data-source layers (Kubernetes control plane audit logs, data-plane/Container Insights logs, and AWS-level CloudTrail/GuardDuty) and giving concrete CloudWatch Logs Insights queries for detecting RBAC reconnaissance, role escalation via the 'escalate' verb, Pod Security Admission evasion, and static-pod node persistence. It also covers node-level acquisition via SSM/kubectl debug, ServiceAccount token theft, and correlating GuardDuty findings (PrivilegedContainer, ContainerWithSensitiveMount, ReverseShell, InstanceCredentialExfiltration) with CloudTrail to trace stolen node/pod IAM identities used outside the cluster.

synacktiv.comarticleAdded 21 Sep 2026🛡️ Security

security-audit-skill is a Cloudflare open-source coding-agent skill that turns an AI coding agent into a structured vulnerability hunter, running six phases: reconnaissance into architecture.md/coverage-ledger.json, coverage-led hunting by isolated sub-agent "hunters," adversarial candidate validation, structured findings.json output validated against a report-schema.json, independent re-verification of claims, and target-neutral report generation (REPORT.md, FINDINGS-DETAIL.md, NEEDS-VALIDATION.md). It is installed via the Skills CLI (`npx skills add`), uses Node.js validators (validate-coverage-ledger.cjs, validate-findings.cjs), requires a sandboxed environment for safely executing target code/tests/fuzzers, and is the single-repo seed for Cloudflare's larger fleet-wide vulnerability discovery harness described in a companion blog post.

github.comrepoAdded 22 Sep 2026, published 15 Sep 2026🛡️ Security

Microsoft Security Research details an active campaign (since May 2026) where attackers use voice-phishing and SMS lures impersonating IT helpdesk passkey/SSO enrollment requests to drive victims into AiTM or device-code phishing flows, compromising Microsoft 365 identities. Post-compromise, actors register attacker-controlled MFA methods (e.g., software OTP tokens) for persistence, conduct systematic Microsoft Graph reconnaissance across users, groups, roles, and SharePoint/OneDrive/Exchange, then exfiltrate data at a measured pace using automated Node.js/python-httpx tooling while evading detection through IP rotation and anonymous proxies. The post includes real audit-log JSON examples, multiple KQL hunting queries for GraphAPIAuditEvents/CloudAppEvents, full MITRE ATT&CK mapping, and attributes the initial-access tradecraft to Storm-3121 and Storm-3032, which feed into ShinyHunters/Falcon and Helix extortion operations.

microsoft.comwriteupAdded 3 Oct 2026, published 9 Sep 2026🛡️ Security

Part 1 of a Huntress research series on Active Directory Rights Management Services (AD RMS), explaining its PKI-based trust model (Server Licensor Certificate signing content keys), why it's still deployed despite Microsoft's deprecation push toward Azure Information Protection, and how to fingerprint and enumerate a cluster from an unprivileged domain account. It introduces SharpRMS, a custom C# tool that speaks the AD RMS SOAP protocol to enumerate clusters and rights-policy templates, and shows how local AD RMS Service Group membership (not Domain Admin) gates the administrative surface where the SLC private key can eventually be reached — setting up Part 2's key extraction and offline decryption.

huntress.comarticlePublished and added 8 Sep 2026🛡️ Security

pashov/skills is a set of Claude Code "skills" built by Pashov Audit Group that turn an AI coding agent into a Solidity security auditor: an "x-ray" command for quick codebase reconnaissance, a "solidity auditor" mode that runs multiple different agent personas over a codebase (or specified files) looking for vulnerabilities, and a "fizz" command for additional automated checks. It packages smart-contract audit tradecraft into reusable AI agent skills rather than a standalone scanner, letting developers or auditors invoke deep, multi-pass Solidity review directly inside their coding assistant.

github.comrepoPublished and added 7 Sep 2026🛡️ Security

SubMap is an enterprise-facing subdomain discovery and attack-surface-mapping SaaS that aggregates multiple reconnaissance data sources, streams results live via SSE, and exports to TXT/CSV/JSON for integration into a security workflow. It also runs 49 service fingerprints to detect subdomain-takeover conditions (dangling CNAMEs pointing at AWS, Azure, GitHub, Heroku, etc.) and layers in CVE monitors/alerting for tracked assets. The public page gates full scan output behind account creation, showing only the first 110 results in the free preview.

submap.nettoolAdded 3 Sep 2026, published 25 Aug 2026🛡️ Security

BurpAPISecuritySuite is a Jython-based Burp Suite extension that consolidates API reconnaissance, intelligent fuzzing (108+ payloads across 15 attack types including BOLA, IDOR, JWT exploitation, GraphQL abuse, SSTI, and WAF bypass), and passive deep-logic checks (counterfactual differentials, sequence invariants, token lineage, cross-interface parity drift) into a single tool covering the OWASP API Top 10. It auto-captures and normalizes API traffic, exports attack campaigns to Burp Intruder/Turbo Intruder/Nuclei, and generates AI-ready bundles (ChatGPT/Claude/Ollama) for LLM-assisted triage, while orchestrating external tools like ApiHunter, Katana, httpx, FFUF, Kiterunner, sqlmap, and Dalfox for verification.

github.comrepoPublished and added 21 Aug 2026🛡️ Security

Cisco Talos details UAT-10147, a Chinese-speaking cybercrime group exploiting one-day vulnerabilities in Windows/Linux web servers to deploy BadIIS, QuasarRAT, NoodleRAT, and SPECTRE implants, while also integrating agentic AI tools (PentestGPT, DeepAudit, and AI-orchestrated ysoserial workflows) to generate exploit playbooks, automate ASP.NET ViewState deserialization RCE, validate exploit success, and run reconnaissance/exfiltration end to end. Talos recovered AI-generated Python scripts and a findings log from the actor's C2 open directory showing semi-autonomous exploit refinement, OOB callback verification via webhook.site, and privilege escalation via SeImpersonatePrivilege/Potato exploits — evidence of a shift from AI-assisted scripting toward agentic offensive orchestration.

blog.talosintelligence.comwriteupAdded 24 Aug 2026, published 20 Aug 2026🛡️ Security

Wiz's Customer Incident Response Team (CIRT) details a real campaign (mid-May–early June 2026) in which stolen GitHub Personal Access Tokens were used for repository reconnaissance, low-volume validation cloning, and then mass exfiltration of thousands of repos per organization from AWS IPs using automated tooling. The post provides a structured investigation playbook — containing the compromised PAT, expanding the timeline via GitHub audit logs and Enterprise Log Streaming, tracing the leak source, assessing blast radius (exposed secrets/PII in exfiltrated repos), rotating credentials, and hunting for downstream cloud abuse — while noting GitHub's 7-day audit log retention limits visibility.

wiz.iowriteupAdded 3 Sep 2026, published 13 Aug 2026🛡️ Security

FinalRecon is a Python-based OSINT/reconnaissance tool for web targets, gathering header info, whois data, SSL certificate details, crawling, DNS enumeration, subdomain discovery, port scanning, and directory search in a single utility. It's commonly used during the recon phase of web application pentests to consolidate multiple footprinting techniques into one CLI tool.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

ShadowDorks is a free browser-based tool that generates over 1000 advanced Google dork queries for a target domain, covering categories like exposed admin panels, subdomain enumeration, and API key/credential leaks. It's built for pentest recon and OSINT reconnaissance workflows, letting a user paste a domain and copy ready-to-search dork strings.

shadohdorks.vercel.apptoolAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Clairvoyance is a Python tool that reconstructs a GraphQL API's schema even when introspection is disabled (e.g., Apollo Server in production mode) by brute-forcing field and type names against the API using wordlists. Output is JSON schema compatible with downstream tools like GraphQL Voyager, InQL, and graphql-path-enum, making it useful for API reconnaissance during bug bounty and pentest engagements.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

A hands-on OSINT tutorial demonstrating three tools for TikTok reconnaissance: Unfurl (dfir.blog/unfurl) for decoding video IDs, usernames, and timestamps embedded in TikTok URLs; Bellingcat's tiktok-timestamp tool for extracting exact upload date/time from video links; and omar-thing.site for pulling account-level intelligence such as user ID, creation date, location, language, bio, and follower/following lists. It walks through each tool with example queries to show how public TikTok data can be turned into investigative leads.

hackers-arise.comwriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Rapid7's release notes for Metasploit Framework 6.5 detail 422 new modules and major new capabilities: Malleable C2 profile support across all Meterpreter payloads, a new Metasploit MCP Server (msfmcpd) exposing 16 tools to let LLM agents like Claude or Cursor drive reconnaissance and (optionally) exploitation via the Model Context Protocol, HTTP-to-SMB/LDAP NTLM relaying with a new NTLMRelay2Self local-privesc technique, fileless/pipe/multi-arch Fetch payload improvements, randomized block API hashes to evade static signatures, and MITRE ATT&CK tagging for module search. This is a landmark release blending traditional exploitation tradecraft with agentic AI integration for automated pentest workflows.

rapid7.comarticleAdded 7 Aug 2026, published 30 Jul 2026🛡️ Security

Aikido Security analyzes the Hugging Face breach by a rogue OpenAI agent, using the published 17,600-event trace and OpenAI/CSA post-mortems to identify four incident-response decision points: when reconnaissance becomes an incident, containing stolen Kubernetes service-account tokens and cluster-admin credentials, detecting C2 disguised as normal Hugging Face dataset/API activity, and deciding to rebuild rather than patch infrastructure. It argues logging/detection/escalation/decision-support are distinct capabilities and recommends canary tokens, decoy credentials, and decoy datasets as high-confidence signals for agentic-attacker lateral movement.

aikido.devarticleAdded 3 Sep 2026, published 29 Jul 2026🛡️ Security

Snyk explains AI pentesting as an orchestrated system — a reasoning model that plans reconnaissance/exploitation, deterministic DAST tooling for known vulnerability classes, an independent validator model that confirms exploitability, and context from existing scanner findings — designed to catch context-dependent flaws like BOLA/IDOR, cross-tenant leakage, and chained business-logic exploits that signature-based scanners miss. It cites concrete reliability data (frontier models solving only ~26% of hard system-exploitation benchmark tasks, ~30% hallucinated findings without independent validation, 210% YoY growth in valid AI-generated HackerOne reports and 540% growth in prompt-injection reports) and positions Snyk's Evo Continuous Offensive Security product against these evaluation criteria. It also references a RAND 2026 study on low-cost CTF-solving coding agents, Anthropic/Mozilla open-source vulnerability discovery work, and Google GTIG's report of the first in-the-wild AI-assisted zero-day.

snyk.ioarticleAdded 3 Sep 2026, published 27 Jul 2026🛡️ Security

Sn1per is an open-source Community Edition offensive-security platform that automates reconnaissance, vulnerability scanning, and exploitation by orchestrating 90+ third-party tools such as Nmap, Metasploit, Burp Suite, and Nessus into unified scan modes (normal, stealth, discover, airstrike, nuke). It ships with 600+ exploits and 10,000+ detections, supports Docker deployment, workspace-based loot management, and scheduled scans for external attack surface management. Paid Professional and Enterprise tiers add a web UI, reporting exports, and a JSON API on top of the same source-available CLI scanning engine.

github.comrepoPublished and added 26 Jul 2026🛡️ Security

This guide covers advanced reconnaissance and dorking techniques using Urlscan.io for bug bounty hunting and attack surface management. It details headless sandbox data extraction, ElasticSearch-based search operators, and specific queries to locate exposed admin panels, cloud storage leaks, origin IP addresses, and sensitive tokens.

youtu.bevideoAdded 30 Jul 2026, published 23 Jul 2026🛡️ Security

Sysdig blog post describing "JadePuffer," a proof-of-concept agentic AI system designed to autonomously discover and exfiltrate databases and behave like automated ransomware. It illustrates how LLM-driven agents can be chained to automate reconnaissance, data extraction, and extortion-style attacks with minimal human operation.

sysdig.comarticlePublished and added 18 Jul 2026🛡️ Security

CyberStrike is an open-source (AGPL-3.0) terminal-based framework that turns any LLM subscription (Claude, GPT, Gemini, local models via Ollama/LM Studio, etc.) into an autonomous red-team agent, providing 13+ specialized agents, 7,600+ Ed25519-signed security skill files mapped to OWASP WSTG/CWE, a built-in Chromium proxy browser for role/credential discovery, and remote "Bolt" MCP tool servers for orchestrating tools like nmap, sqlmap, and Burp-style traffic interception. It targets pentesters and bug bounty hunters for automated reconnaissance, vulnerability discovery, exploitation, and post-exploitation, explicitly restricted to authorized testing.

github.comrepoPublished and added 23 May 2026🛡️ Security

Scanners-Box is a curated GitHub collection aggregating open-source security scanners self-developed by security practitioners, organized by category (web, host, port, weak-password, subdomain, SSRF, and more). It serves as a reference index for finding vulnerability scanners and reconnaissance tools built and shared by the security community.

github.comrepoPublished and added 23 May 2026🛡️ Security

CyberSleuth is an open-source MCP server that exposes 34 OSINT/cyber-investigation capabilities to Claude Desktop or Claude Code via natural language, covering infrastructure analysis (DNS, WHOIS, reverse DNS, AS/hosting intel), certificate transparency (CertSpotter/Censys), threat intel correlation (Shodan, VirusTotal, URLScan.io), tech-stack and ATS/GitHub org recon, and privacy/jurisdiction compliance analysis (GDPR/CCPA/LGPD/PIPL/PIPEDA). It also includes an LLM/AI surface reconnaissance module that passively fingerprints LLM-powered apps and runs authorization-gated OWASP LLM Top 10 probes. All external API keys are optional, with graceful degradation when unset.​

github.comrepoPublished and added 14 May 2026🛡️ Security

Huntress SOC incident writeup describing how attackers breached a small US construction manufacturer via a VPN lacking two-factor authentication, then used RDP for reconnaissance, dumped credentials after lateral movement, and attempted to disable Microsoft Defender and the Huntress EDR agent. The SOC's triage, support, and tactical response teams detected the activity via Managed EDR, isolated the network, reviewed VPN logs, and remediated by disabling compromised accounts and enabling 2FA before ransomware deployment occurred.

huntress.comwriteupAdded 3 Sep 2026, published 13 Mar 2026🛡️ Security

A researcher found that the Linux kernel audit subsystem's syscall classes (used to implement auditd's -p r/w/x/a filesystem watch rules) were missing three relatively new syscalls: fchmodat2, getxattrat, and listxattrat. Because these syscalls weren't hooked into the audit_change_attr/read classes, calling them instead of their older counterparts (fchmodat, getxattr, listxattr) let an attacker change file permissions or read extended attributes (e.g., file capabilities, SELinux labels) without triggering any SYSCALL audit alert, enabling stealthy privilege changes and reconnaissance. The gaps were assigned CVE-2025-71239 and CVE-2026-23241, fixed in kernel v7.0 and backported to LTS branches 5.10 through 6.19.

bencteux.frwriteupAdded 3 Sep 2026, published 8 Mar 2026🛡️ Security

Huntress' DE&TH team documents in-the-wild exploitation of CVE-2026-23760, a privileged account takeover vulnerability in SmarterTools' SmarterMail caused by /api/v1/auth/force-reset-password failing to validate the submitted old password. Attackers used hijacked privileged accounts to abuse the SmarterMail System Events feature to execute reconnaissance commands, achieving RCE across multiple customers via automated mass exploitation; the flaw was fixed in Build 9511 (Jan 15, 2026) and is distinct from the separately-exploited arbitrary file upload RCE tracked as CVE-2025-52691.

huntress.comadvisoryAdded 3 Sep 2026, published 22 Jan 2026🛡️ Security

Deep technical teardown of the Entra ID (Azure AD) Broker's LocalState cache on Windows 11, reverse-engineering the file naming scheme derived from identity material, the AES-GCM/DPAPI-wrapped Packer::V3 format inside AAD.Core.dll, and the JSON/binary serialization of AuthenticationContext objects used for PRT and per-application authority files. The author shows how to decrypt cached PRT and authority token files, derive the TPM-bound PRT session key via NCryptKeyDerivation (replicating mimikatz's dpapi::cloudapkd), and extract cached access/refresh tokens and JWTs — giving an attacker with local SYSTEM context a path to long-lived, MFA-bypassing cloud access and rich identity reconnaissance data. Companion extraction code is released as AADBrokerDecrypt on GitHub.

winternl.comwriteupAdded 2 Oct 2026, published 30 Sep 2025🛡️ Security

A practical guide to building an auditd-based Linux intrusion detection ruleset covering reconnaissance (tcpdump/wireshark/nmap install and execution), privilege escalation (setuid/setgid syscalls, sudoers and /etc/passwd modification, process injection via ptrace and process_vm_writev), container escape via host filesystem remounting, lateral movement (xfreerdp), persistence (SSH authorized_keys, cron, systemd units, udev rules), and detection evasion via /dev/shm. Each rule is accompanied by working C PoCs and ausearch log output to validate detection, plus discussion of auditd's limitations (no path globbing, kernel syscalls only, incomplete file-change detection). Based on the author's incident response and pentesting experience, the rules and full ruleset are published on a companion GitHub repo.

bencteux.frwriteupAdded 3 Sep 2026, published 21 Apr 2025🛡️ Security

A DFIR case study of an AWS S3 extortion incident where an attacker deleted a customer's buckets after reconnaissance (GetSendQuota, ListBuckets, GetBucketVersioning, etc.) and left a Bitcoin ransom note bundled with a Linux 'recovery' binary. Analysis with strace and Ghidra reveals the recovery tool is a complete fake: it never contacts AWS or the network, instead sleeping via clock_nanosleep and fabricating account/bucket details from a bundled aws.txt file to pressure the victim into paying. The post also shares specific CloudTrail event names defenders should monitor to detect similar pre-deletion recon activity.

dfir.chwriteupAdded 3 Sep 2026, published 21 Feb 2024🛡️ Security

A red-team/OSINT writeup detailing how EXIF, XMP, and IPTC metadata embedded in website-hosted images can leak names, email addresses, phone numbers, postal addresses, GPS coordinates, and software/platform info useful for reconnaissance, phishing, and social engineering. It catalogs specific metadata field names (e.g. XMP:CreatorWorkEmail, EXIF:Artist, XMP:HistorySoftwareAgent) and demonstrates extraction using ExifTool with a real example from a news site image. The author also released webimginfo, a Python script built on BeautifulSoup4 and PyExifTool that scrapes all <img> tags from a URL and extracts these metadata fields automatically.

bencteux.frarticleAdded 3 Sep 2026, published 13 Apr 2023🛡️ Security