Chihuahua in charge NotMe (@jessefmoore) header
Chihuahua in charge NotMe (@jessefmoore) profile picture

Sr. CyberSecurity Advisor, tweets are my own opinions and thoughts and do not reflect my past or current employers. https://xitter.gq/t.co/TDDXXW76Vw

Joined July 2009
Photo by Chihuahua in charge NotMe (@jessefmoore)Photo by Chihuahua in charge NotMe (@jessefmoore)Photo by Chihuahua in charge NotMe (@jessefmoore)Photo by Chihuahua in charge NotMe (@jessefmoore)Photo by Chihuahua in charge NotMe (@jessefmoore)Photo by Chihuahua in charge NotMe (@jessefmoore)Photo by Chihuahua in charge NotMe (@jessefmoore)Photo by Chihuahua in charge NotMe (@jessefmoore)
Chihuahua in charge NotMe retweeted
Happy #BloodHoundBasics courtesy of Jacob Jackson! New in BloodHound Enterprise: Findings Prioritization (Early Access). Go beyond severity ratings with risk-based rankings to focus remediation where it matters most. ghst.ly/4yLaBlK
1
1,272
Chihuahua in charge NotMe retweeted
Results are in... Congrats to @stuk0v_ winner of our OpenGraph Halloween Art Competition! 🎃 Check out Mat’s winning design below & join us in giving him a round of applause. Thanks to everyone who submitted a design & brought some Halloween spirit to the BloodHound community!
3
12
1,347
Chihuahua in charge NotMe retweeted
Bypassing SMB signing enforcement🔥 @aas_s3curity found a re-authentication bug in SMB. This allows you to simply relay an authentication to a host (e.g., a DC) even if signing is enforced! His NetExec module to test if a host is still vulnerable is now merged into main🚀 1/3🧵
9
102
3
518
23,170
Chihuahua in charge NotMe retweeted
1/2 LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced. Patched in October. Blog: specterops.io/blog/2026/10/2… PoC: github.com/grayhatkiller/swi…
8
121
2
288
20,731
Chihuahua in charge NotMe retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included. blackfield.ch/blog/defeating…
4
56
1
157
8,735
Chihuahua in charge NotMe retweeted
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
233
1,574
239
25,994
824,811
Chihuahua in charge NotMe retweeted
I made a short video that explains Entra app permissions and the part they played in the ConnectWise incident: how one app credential reached 173+ Microsoft 365 tenants with no password or MFA, and what to check today. youtube.com/watch?v=Q36aL_HI…
12
38
3
195
19,003
Chihuahua in charge NotMe retweeted
Every app with consent in your tenant is a potential attack path. AzureHound, our open-source collector, maps Entra ID apps and their permissions: ghst.ly/4efrqhg 3/4
1
1
8
733
Chihuahua in charge NotMe retweeted
What to check: • Service principal sign-ins from app ID 506e08f9-6e9a-4da4-942b-a099a03644ae • Activity from 144.172.64[.]128 Not using SkyKick or ConnectWise Cloud Backup? Revoke its app consents in your tenant. 2/4
1
1
4
712
Chihuahua in charge NotMe retweeted
PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants. 🧵1/4
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵
5
15
1
72
7,562
Chihuahua in charge NotMe retweeted
If you're into adversary simulation, identity security or red/blue tradecraft, bookmark this. The team at @SpecterOps has built one of the best FREE security research archives online. The rabbit hole covers: - Active Directory + Kerberos - Entra ID + Azure - Okta + identity providers - BloodHound + attack paths - SCCM / Configuration Manager - Red team tradecraft - Detection engineering - Lateral movement - Credential access - OAuth + token security - Browser persistence - AWS + cloud attack paths - Kubernetes security - Software supply chain attacks - Adversary simulation - Purple teaming - Threat hunting - AI-assisted offensive security There is a ridiculous amount of deep technical material here, including research developed from real offensive and defensive operations. They also now have FREE on-demand Tradecraft Academy courses covering BloodHound, Kubernetes for Red Teamers and software supply chain security. Blog: specterops.io/blog/ Free Tradecraft Academy: academy.specterops.io/ Huge credit to the @SpecterOps team for publishing so much of this openly. #RedTeam #ActiveDirectory #Infosec
1
60
296
12,932
Chihuahua in charge NotMe retweeted
A validly signed pythonw.exe we caught ran with zero arguments: its payload sat in a path configuration file Python reads at startup, invisible to any command-line rule. Least privilege stopped ScreenConnect it carried. activesoc.blackhillsinfosec.…
1
10
2
47
3,270
Chihuahua in charge NotMe retweeted
Office drama and you don't want to get involved l.
133
3,712
349
16,111
551,369
Chihuahua in charge NotMe retweeted
📄 Skills in Agent Harnesses A lot of people don't know this (I didn't until recently) but most agent harnesses will load the description of your skill upon starting up your harness. This is how Claude Code works. What people don't usually know is that even when you explicitly call a skill to be used inside of a harness, or the AI figures out to use a skill, it usually only does a read of the first 150 lines of the skill (to understand how to use it or if it applies to the work it's trying to do). It's really important to outline a table in the first 150 lines of the mandatory parts of the skill that must be run when you invoke the skill. If you make some type of mandatory instruction after 150 lines, it might get missed entirely. If you describe in prompting that you want to use a provided Python script or template, it also might be out of bounds of that 150 lines and never get called correctly. If you write a table of contents of the skill actions in the first 150 lines and mark which ones are mandatory (or that, if the user has called the skill, you must read the whole skill context and all references), you get more reliable skills. We use markdown checklists for this now.
40
91
4
677
45,128
Chihuahua in charge NotMe retweeted
Uncensored AI for Offensive Security is still free in the WKL Student Portal! Deploy your own LLM and run it across AMSI bypasses, Defender evasion, OSINT parsing, and phishing artifacts while keeping your data local. Learn more: bit.ly/4aV3wWW
1
13
582
Chihuahua in charge NotMe retweeted
🚨 Fresh Living off the Land Weekly is out Forty-five merged pull requests from 12 contributors landed across LOLDrivers, HijackLibs, LOOBins, and LOLRMM. The work expanded driver and DLL sideloading research, documented macOS utilities, strengthened remote-management artifacts and detections, and improved public catalogs and their publishing workflows. Thank you, contributors! magicsword.io/changelog/lotl magicsword.io/changelog/lotl…
5
25
1,072
Chihuahua in charge NotMe retweeted
Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse! EDR Eclipse is also compatible with ShellcodePack and MacroPack formats as well as all major C2s! blog.balliskit.com/tutorial-… #redteam
26
127
8,293
Chihuahua in charge NotMe retweeted
“They don't have guardrails.” @jaredcatkinson & @JustinKohler10 are joined by @Icemoonhsv & @elad_shamir for the latest #KnowYourAdversary. In this ep. the group explores unpredictable agents and the security challenges they pose. 👉 ghst.ly/4gS0KFc
3
2
1,394