TL;DR : An attacker could transfer StrongDM state files, which hold session authentication information, between hosts to provide authenticated sessions.…
Research & Tradecraft
TL;DR: Building a security program and exercising it are not the same investment. Most organizations prioritize the first and defer the…
Research & Tradecraft
TL;DR: Phishing sandboxes are a pain. Cloudflare Turnstile can be used as an effective solution to conceal your phishing pages.…
TL;DR : Splunk is a daunting SIEM to learn, but this learning curve can be flattened by learning to use…
Research & Tradecraft
TL;DR: TailscaleHound is an OpenGraph collector for BloodHound that maps Tailscale users, devices, groups, tags, ACLs, grants, SSH rules, routes,…
By: Andrew Luke, Andrew Gomez
TL;DR: A year ago, my company handed me a project bigger than anything I’d worked on before. The project was…
Research & Tradecraft
TL;DR: Two command injection vulnerabilities exist in the Windows Explorer “Open PowerShell window here” context due to improper quoting…
Research & Tradecraft
Dev Tunnels aren’t "just port forwarding". They consist of layers of embedded protocols with RPC messages being exchanged. Once you…
Research & Tradecraft
TL;DR: Red teaming means different things to different vendors. We how SpecterOps defines it, why engagements start from assumed…
" * " indicates required fields
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
