kübergeek @kubergeek

Joined June 2016

Tweets

7K
Followers

126
Following

843
Likes

2K

Florian Hansemann @CyberWarship

2 weeks ago

''GitHub - 0xflux/Hells-Hollow: Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls'' #infosec #pentest #redteam #blueteam github.com/0xflux/Hells-H…

1 34 106 7K 64

Mehmet Ergene @Cyb3rMonk

a month ago

🚨 SOC Analysts, Incident Responders, and Detection Engineers, Be careful when using the new SessionId information in Entra ID. Learn why 👇 academy.bluraven.io/blog/hidden-ga… #ThreatHunting #DetectionEngineering #IncidentResponse #DFIR

0 28 120 5K 73

The Print Spooler service is a default service on Windows Servers and is set to run at startup. There are a number of attacks that are enabled by having the Print Spooler service running on Domain Controllers (ex.: Printer Bug: adsecurity.org/?p=4056) At this point it's best to…

3 37 155 11K 125

Download Image

Bert-Jan 🛡️ @BertJanCyber

2 months ago

Sorry to disturb your weekend. There is a SharePoint 0day actively abused. Do not only focus on the rule of MSRC for hunting, other blogs also share different files and folders in use! Additional info: MSRC: msrc.microsoft.com/blog/2025/07/c… Blog by @eyesecurity_: research.eye.security/sharepoint-und…

1 21 46 9K 47

Dirk-jan @_dirkjan

2 months ago

If you want to know how to bring your own IDP in Entra, and abuse OIDC protocols for persistence, my x33fcon talk is now on YouTube 😀

/ˈziːf-kɒn/ @x33fcon

2 months ago

If you want to know how to bring your own IDP in Entra, and abuse OIDC protocols for persistence, my x33fcon talk is now on YouTube 😀

3 34 117 19K 58

Download Image

3 54 166 12K 83

Sean Metcalf @PyroTek3

2 months ago

Want to detect Kerberoasting with no false positives? Setup a honeypot account for detection following the guidance in this article: hub.trimarcsecurity.com/post/trimarc-r… #ActiveDirectorySecurityTip

2 58 260 18K 233

Mehmet Ergene @Cyb3rMonk

2 months ago

🚨 Detection Engineers, Threat Hunters, and SOC analysts, This is especially for you. academy.bluraven.io/blog/how-netwo… #ThreatHunting #DetectionEngineering

5 44 199 12K 174

The Hacker News @TheHackersNews

2 months ago

🚨 A Ukrainian military phishing campaign just escalated. GIFTEDCROOK malware now steals not just browser data—but sensitive documents, emails, and VPN configs. It hides in fake Excel files, exfiltrates via Telegram, and wipes its tracks. The goal? Targeted intelligence ops.…

1 27 64 17K 22

Download Image

TKYN @TKYNSEC

3 months ago

Windows 11 24H2 broke a popular malware evasion technique! The Lloyd Labs self-deletion method now fails because of NTFS changes, so I spent time with kernel debugging to figure out why and how to fix it. Full technical breakdown: tkyn.dev/2025-6-8-The-N…

7 106 334 35K 220

Alexandre Borges @ale_sp_brazil

6 months ago

To date, I have published 15 articles (1045 pages) with the strict goal of helping the cybersecurity community. ERS (439 pages, so far): [+] ERS 05: exploitreversing.com/2025/03/12/exp… [+] ERS 04: exploitreversing.com/2025/02/04/exp… [+] ERS 03: exploitreversing.com/2025/01/22/exp… [+] ERS 02:…

8 124 442 25K 324

Web Security Academy @WebSecAcademy

6 months ago

✨ The "File Upload Vulnerabilities" Learning Path ✨ In this learning path, you'll explore how simple file upload functions can become a vector for severe attacks. You'll learn how to bypass common defense mechanisms to upload a web shell, enabling full control over a…

0 8 39 3K 11

Download Image

hasherezade @hasherezade

6 months ago

#PEbear (github.com/hasherezade/pe…) is now available via WinGet (learn.microsoft.com/en-us/windows/…)! You can install it easier than ever - just type: `winget install pe-bear` from Powershell.

6 66 315 21K 72

Download Image

Intigriti @intigriti

9 months ago

Do you want to master authentication bypasses? 🤑 Open this thread! 🧵👇

3 148 812 60K 874

Download Image

Dirk-jan @_dirkjan

9 months ago

Want to run roadrecon, but a device compliance policy is getting in your way? You can use the Intune Company Portal client ID, which is a hardcoded and undocumented exclusion in CA for device compliance. It has user_impersonation rights on the AAD Graph 😃

6 119 349 36K 200

Dirk-jan @_dirkjan

9 months ago

Awesome work by Lance, clear write-up on the issue, the solution, a PR to ROADtools and more tradecraft!

SpecterOps @SpecterOps

9 months ago

Awesome work by Lance, clear write-up on the issue, the solution, a PR to ROADtools and more tradecraft!

1 54 148 19K 70

Download Image

1 26 74 10K 33

Sam Altman @sama

9 months ago

today we are announcing reinforcement finetuning, which makes it really easy to create expert models in specific domains with very little training data. livestream going now: openai.com/12-days/ alpha program starting now, launching publicly in q1

377 765 8K 1.2M 3K

hasherezade @hasherezade

9 months ago

Updated #TinyTracer (v2.9) is out: github.com/hasherezade/ti… ! Now you can trace indirect #syscalls, and dump context before each logged instruction.

5 87 290 23K 93

Download Image

ESET Research @ESETresearch

9 months ago

UPDATE: #ESETresearch was contacted by one of the possible authors of the Bootkitty bootkit, claiming the bootkit is a part of project created by cybersecurity students participating in Korea's Best of the Best (BoB) training program. 1/2 welivesecurity.com/en/eset-resear…

10 66 207 24K 79

The Hacker News @TheHackersNews

10 months ago

Google's AI-driven tool OSS-Fuzz uncovered 26 flaws across various open-source repositories, including a serious flaw (CVE-2024-9143) in OpenSSL, marking a milestone in automated #vulnerability detection. Read the full article here — thehackernews.com/2024/11/google… #cybersecurity

1 58 109 15K 18

The Hacker News @TheHackersNews

10 months ago

🔒 Decade-old vulnerabilities in Ubuntu Server’s needrestart package allow local attackers to gain root privileges with no user interaction. Learn more about how these flaws work: thehackernews.com/2024/11/decade… #infosec #cybersecurity #Linux