Jim Saveker @jsaveker

Security Person @ Perpetual | Catching badness, calming nerves | Opinions mine, detections shared saveker.org Austin, TX Joined August 2007

Tweets

27
Followers

75
Following

218
Likes

42

Jim Saveker @jsaveker

3 days ago

TAG-150 speedrunning malware dev: CastleLoader > CastleBot > CastleRAT in months. Multi-tier C2, Python + C implants, abuse of legitimate services. recordedfuture.com/research/from-…

0 0 0 30 0

Jim Saveker @jsaveker

4 days ago

If you’re not abusing both DNS and ICMP in your RAT, are you even modern malware? gbhackers.com/weaponizing-dn…

0 0 0 150 0

UNC6395 abused compromised OAuth tokens from the Salesloft Drift integration to exfiltrate data from Salesforce, including AWS keys/Snowflake creds. So what: SaaS integrations expand your attack surface as much as your own code, but with far less visibility or control.…

0 0 1 258 0

Jim Saveker @jsaveker

2 weeks ago

Bad actors are straight‑up ghosting your EDR by using Windows internals folks rarely monitor. No SYSTEM, no write‑to‑disk, just NtOpenKeyEx + SeBackupPrivilege + RegQueryMultipleValuesW = creds exfiltration in stealth mode. #Cybersecurity #EDRevasion

0 0 0 51 0

Jim Saveker @jsaveker

3 weeks ago

Saw a post that suggested Copilot could access files without audit logs. If true, that’s a big deal: no traceability, compliance gaps, blind SOCs, insider risk. Fixed or not, the AI attack surface is growing fast. Guardrails aren’t optional.

0 0 0 38 0

Jim Saveker @jsaveker

3 weeks ago

If your “attack path” is a 3-page IR note, you shipped prose not signal. Render the attack graph in the ticket...edges, nodes, blast radius. Humans parse DAGs faster than paragraphs. #detectionengineering #detectioneng

0 0 0 39 0

Jim Saveker @jsaveker

3 weeks ago

Cisco FMC RADIUS bug is CVSS 10.0 “free shell with auth.” Patch before someone else manages your management plane. bleepingcomputer.com/news/security/…

0 0 0 34 0

Jim Saveker @jsaveker

3 weeks ago

Feature flags are change events. In detection land, they’re deploys without commits. Monitor toggles, log owners, and alert on risky changes seen in conjunction with unusual auth, config drift, or suspicious traffic patterns.

0 0 0 24 0

Jim Saveker @jsaveker

4 weeks ago

Denylists are meh. Stronger: invariants. Define truths like “no human token gets admin:*” or “prod can’t hit the internet.” Alert on violations = low-noise wins. #thunting #soc #detectioneng

0 0 0 27 0

Jim Saveker @jsaveker

4 weeks ago

Without eBPF, cloud logs miss the “how.” Without cloud logs, eBPF misses the “who.” Use both and your incident narratives write themselves. #thunting #detectioneng

0 0 0 36 0

Jim Saveker @jsaveker

4 weeks ago

Passkeys stop password theft. Stolen tokens still might work. Detect replay, not just resets.

1 0 0 34 0

Jim Saveker @jsaveker

4 weeks ago

OAuth consent popups are the new macros. Create signals on risky scopes, not app names.

0 0 0 36 0

Jim Saveker @jsaveker

4 weeks ago

This isn’t a jailbreak; it’s ambient auth abuse. A poisoned Calendar title hijacks Gemini to leak mail + poke your devices…no extra clicks beyond normal use. Treat every agent tool like prod auth. bleepingcomputer.com/news/security/…

0 0 0 173 0

Jim Saveker @jsaveker

4 weeks ago

Watch Entra ID for sudden changes to the Exchange hybrid app, unexpected cred uploads to “Office 365 Exchange Online,” EWS/Graph permission spikes, and token-mint anomalies originating from on-prem. #thunting #CVE 2025-53786 bleepingcomputer.com/news/security/…

0 0 0 96 0

Jim Saveker @jsaveker

4 weeks ago

Cloud D&R tip: Credentials are gold. Monitor token issuance & refresh events…not just logins.

0 0 0 36 0

Jim Saveker @jsaveker

4 weeks ago

S3 pre-signed URLs are paper cuts that bleed. Pay careful attention to mass share patterns. Many SaaS apps sling S3 pre-signed URLs for report downloads. This is great for speed, terrible for tracking who just shared it with the whole internet.

0 0 0 42 0

Download Image

Jim Saveker @jsaveker

4 weeks ago

DNS over HTTPS kill your DNS hunts? Pivot to TLS: hunt high-entropy SNIs, missing SNI, SNI cert mismatches & rare JA3/4s. Beacon cadence still leaks!!! #thunting

0 0 0 241 0

Jim Saveker @jsaveker

4 weeks ago

SSRF is still the classic cloud rootkit. Alert on metadata service hits + sudden role assumptions. You’d be shocked how often IMDSv1 is still hanging around from legacy builds or re-enabled for ‘temporary’ troubleshooting.