[BLOG]
Integrating Tradecraft Garden PIC loaders into Cobalt Strike
rastamouse.me/harvesting-t...

This is all part of a broader arch. Advocate for research as a public good, advocate for researchers, and don't let others short-sighted self-interest & lack of imagination create a situation that only benefits them. How? Offer a win-win vision that honors (what were once) shared values. ...

It's also a way to continue to encourage, pyramid of pain thinking in the industry. Chase the behaviors. Chase the tradecraft. Sort by most popular tool, write the 100th signature for an already signatured detection surface, doesn't yield gains--makes a lazy blog post on a slow day, but not progress

Planting a Tradecraft Garden

aff-wg.org/2025/06/04/p...

And, what of Breach Intel? A culture that values ground truth and sober/blameless discussion. A focus on root causes, contributing factors, and actionable remediations... not sensationalized tool/actor porn. It's possible:

www.cisa.gov/news-events/...

I think of it as an umbrella ideal.

I made predictions in 2019 at my last talk. A keynote lamenting things were going in a VERY bad direction for hackers. This climate continues. I'm trying steps to influence these trends too. Easier as a ghost more removed from these trends vs. someone being crushed by them

H/T x.com/edskoudis/st...

[Blog] This ended up being a great applied research project with my co-worker Dylan Tran on weaponizing a technique for fileless DCOM lateral movement based on the original work of James Forshaw. Defensive recommendations provided.

- Blog: ibm.com/think/news/f...
- PoC: github.com/xforcered/Fo...

All these people thinking anything is actually “deleted” when you tell them to…re 23andme. Ha.

Someone has done an excellent job collecting RATs and documenting them by version. They also included images.

A+ work. This is amazing (we're going to ingest this eventually)

github.com/Cryakl/Ultim...

Reposting here so people don’t have to go..there. “Loki C2 blog drop”. All credit to Bobby Cook (0xBoku), I’m just relaying.

securityintelligence.com/x-force/bypa...

Dig through this timeline and you'll figure out what I'm here to do. I spoke to a commercial leader in the offensive security space last year. My words: you're fucking it up.

What I didn't say: I feel compelled, even though I DON'T want the bullshit, to try and fix it.

What does all of this mean?

By the way, who thinks about what does and doesn't work (and why)? Security researchers. Red teams. That's our message. And, when you vilify us, you kick us out of the conversation because we have to protect ourselves too. And, this vilification has gone on for a long damned time.

Imagine a discipline called Breach Intelligence. Instead of describing breaches as tools+actors, we use root-cause analysis to dissect the attack path, identify contrib factor issues, and their mitigations. And, aggregate data about which compensating controls (security products) failed

The Security Conversation - The value of offensive security work is fully realized by participation in the security conversation.

aff-wg.org/2025/03/13/t...

Kicking off a new blog series. We will be exploring and abusing DNS by building a key/value store.

www.offensivecontext.com/abusing-dns-...