Had a blast working with my buddy @max__grim creating this badge! Thanks to @OutflankNL and @MDSecLabs for the conf. It was a blast again ❤️ Looking forward to the next one!

Who’s the real #GrimResource? Spoiler: It’s us! 😏 Here's our latest blog on using MSC files for initial access: outflank.nl/blog/2024/08/13/… Fun fact: @elastic’s post on this technique came from a sample caught by a blue team, originally used by a red team through our OST offering.

@gijs_h wrote a short #FalconFriday blog on detecting MMC abuse, based on the great blog from Elastic Research Lab on the #GrimResource technique. Today’s FalconFriday includes 3 custom detections that can be used in Microsoft Defender. Happy reading! falconforce.nl/falconfriday-…

Attackers collect and analyze data from Active Directory to navigate their target environments. In this #FalconFriday we show you how to detect suspicious data collection attempts that are an indicator of an adversary in your environment. Happy hunting! falconforce.nl/en/blog/20221…

We welcome James to the FalconForce team! 🦅

Got a special serial number from a special person! Amazing glow in the dark coin 🤩 thank you brother, may we void many more warranties together! @jilles_com

Just published an AD Explorer snapshot ingestor for #BloodHound: github.com/c3c/ADExplorerSna…

I published a technical blog post about using Nim for offensive tooling, focusing on my Nimplant project. It includes many lessons learnt and tips & tricks. The blog setup is quite different than what I'm used to writing, so let me know if you like it! casvancooten.com/posts/2021/…

I literally have no idea what I'm doing but this badge my colleagues made looks cool as heck. Thanks for the efforts @max__grim @_inf4mous 💪