Brett Hawkins
@h4wkst3r.bsky.social
📤 135
📥 85
📝 11
Adversary Services @xforce
https://h4wkst3r.github.io
New research just dropped I'll be presenting at
@wearetroopers.bsky.social
next week - Attacking ML Training Infrastructure 💥 Model poisoning for code execution ⚠️ Abusing ML workflows ⚙️ MLOKit updates and new threat hunting rules
www.ibm.com/think/x-forc...
loading . . .
Becoming the trainer: Attacking ML training infrastructure
Learn more about machine learning training environments and infrastructure, as well as different attack scenarios against critical components, including cloud compute, model artifact storage and model...
https://www.ibm.com/think/x-force/becoming-the-trainer-attacking-ml-training-infrastructure
5 months ago
0
1
0
Register while you still can for
@retbandit.bsky.social
and I's
@blackhatevents.bsky.social
#BHUSA
training, seats are filling up fast!!
www.blackhat.com/us-25/traini...
loading . . .
Black Hat
Black Hat
https://www.blackhat.com/us-25/training/schedule/#advanced-red-teaming-against-mlsecops-and-ai-as-a-service-platforms-44366
6 months ago
0
0
0
I am thrilled to be presenting new research on attacking ML training infrastructure at
@wearetroopers.bsky.social
this summer. Stay tuned for a blog post and lots of updates to MLOKit closer to the conference!
7 months ago
0
3
0
reposted by
Brett Hawkins
netbiosX
8 months ago
loading . . .
RemoteMonologue: Weaponizing DCOM for NTLM authentication coercions | IBM
The IBM X-Force Red team covers the fundamentals of COM and DCOM, dives into the RunAs setting and why authentication coercions are impactful and introduces a new credential harvesting tool - RemoteMo...
https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions
0
7
2
Learn 📝 about this emerging topic in a first-of-its-kind
#BHUSA
training from
@retbandit.bsky.social
and I where you will use hands-on labs to perform attacks such as model theft, model poisoning and much more 🤖
blackhat.com/us-25/traini...
loading . . .
Black Hat
Black Hat
https://blackhat.com/us-25/training/schedule/index.html#advanced-red-teaming-against-mlsecops-and-ai-as-a-service-platforms-44366
8 months ago
0
1
1
reposted by
Brett Hawkins
bohops
8 months ago
[Blog] This ended up being a great applied research project with my co-worker Dylan Tran on weaponizing a technique for fileless DCOM lateral movement based on the original work of James Forshaw. Defensive recommendations provided. - Blog:
ibm.com/think/news/f...
- PoC:
github.com/xforcered/Fo...
loading . . .
Fileless lateral movement with trapped COM objects | IBM
New research from IBM X-Force Red has led to the development of a proof-of-concept fileless lateral movement technique by abusing trapped Component Object Model (COM) objects. Get the details.
https://ibm.com/think/news/fileless-lateral-movement-trapped-com-objects
0
15
12
reposted by
Brett Hawkins
Chris Thompson
8 months ago
I am excited to announce the first conference dedicated to the offensive use of AI in security! Request an invite at
offensiveaicon.com
. Co-organized by RemoteThreat, Dreadnode, & DEVSEC.
1
7
3
reposted by
Brett Hawkins
Raphael Mudge
8 months ago
The Security Conversation - The value of offensive security work is fully realized by participation in the security conversation.
aff-wg.org/2025/03/13/t...
0
11
6
reposted by
Brett Hawkins
9 months ago
#MythicTip
Want to start automating stuff with Mythic, but not sure where to start? Check out the built-in Jupyter notebooks with Mythic Scripting installed and have fun! Lots of ready to run examples exist already :) Just log in with the Jupyter token from your .env file
0
9
2
reposted by
Brett Hawkins
Chris Thompson
9 months ago
It was an honor to speak at the
@780thmibdecyber.bsky.social
’s AvengerCon on the use of AI in Offensive Cyber Operations, Vuln Discovery/Weaponization, OST Dev as well as attacking AI systems. Here’s a few slides from the talk… @NSACyber @ARCYBER @CISAgov @US_CYBERCOM
0
3
2
reposted by
Brett Hawkins
Dirk-jan
9 months ago
Normally you can't auth to Entra ID connected webapps with bearer tokens. But if Teams can open SharePoint/OneDrive with an access token, I guess so can we. roadtx now supports opening SharePoint with access tokens in the embedded browser 😀
loading . . .
1
19
8
reposted by
Brett Hawkins
James Forshaw
10 months ago
New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process.
googleprojectzero.blogspot.com/2025/01/wind...
loading . . .
Windows Bug Class: Accessing Trapped COM Objects with IDispatch
Posted by James Forshaw, Google Project Zero Object orientated remoting technologies such as DCOM and .NET Remoting make it very easy ...
https://googleprojectzero.blogspot.com/2025/01/windows-bug-class-accessing-trapped-com.html
2
65
41
If you would like to learn how to attack and defend popular platforms that are used to develop and deploy ML models, early sign-up is now available for
@retbandit.bsky.social
and I's
@blackhatevents.bsky.social
training course ⬇️
www.blackhat.com/us-25/traini...
loading . . .
Black Hat USA 2025
Black Hat USA 2025
https://www.blackhat.com/us-25/training/schedule/index.html#advanced-red-teaming-against-mlsecops-and-ai-as-a-service-platforms-44366
10 months ago
0
0
1
reposted by
Brett Hawkins
Andy Robbins
10 months ago
In Part 1 of my Intune Attack Paths series, I discuss the fundamental components and mechanics of Intune that lead to the emergence of attack paths:
posts.specterops.io/intune-attac...
loading . . .
Intune Attack Paths — Part 1
Intune is an attractive system for adversaries to target…
https://posts.specterops.io/intune-attack-paths-part-1-4ad1882c1811
2
42
19
reposted by
Brett Hawkins
Catalin Cimpanu
10 months ago
Live streams from the last ShmooCon security conference, which took place last week, are available on YouTube
www.youtube.com/playlist?lis...
loading . . .
ShmooCon 2025 - YouTube
You can reach me at https://twitter.com/Strong1Wind
https://www.youtube.com/playlist?list=PLnKSfJ5rXw95HSPVl5L7dqhKpVAx3q_j0
0
29
15
You can find our
@shmoocon.bsky.social
presentation slides at the below GitHub repo. Thanks again to all that attended. Also, thank you to the conference organizers for putting on a great con and having us!
#shmoocon
github.com/h4wkst3r/Con...
add a skeleton here at some point
10 months ago
1
16
12
reposted by
Brett Hawkins
Karl Fosaaen
11 months ago
New
@netspi.bsky.social
blog out today on "Hijacking Azure Machine Learning Notebooks (via Storage Accounts)". This is very similar to Storage Account attacks that have been done against Function/Logic Apps and Cloud Shell -
www.netspi.com/blog/technic...
loading . . .
Hijacking Azure Machine Learning Notebooks (via Storage Accounts)
Abusing Storage Account Permissions to attack Azure Machine Learning notebooks
https://www.netspi.com/blog/technical-blog/cloud-pentesting/hijacking-azure-machine-learning-notebooks/
0
2
1
reposted by
Brett Hawkins
Spencer Alessi
11 months ago
Unequivocally one of the best pieces of writing on Tier 0 there is...
loading . . .
What is Tier Zero — Part 1
Tier Zero is a crucial group of assets in Active Directory (AD) and Azure. Its purpose is to protect the most critical components by…
https://posts.specterops.io/what-is-tier-zero-part-1-e0da9b7cdfca
0
13
3
MLOps platforms are becoming critical to enterprises. This has caused
@retbandit.bsky.social
and I to research these platforms and how they can be abused by attackers. Check out our research we will be presenting
@shmoocon.bsky.social
this week.
securityintelligence.com/x-force/abus...
loading . . .
Abusing MLOps platforms to compromise ML models and enterprise data lakes
With the rush to implement AI across organizations came the increase in the use of MLOps platforms and a greater risk of attack. Learn more about MLOps platforms and how threat actors are using them.
https://securityintelligence.com/x-force/abusing-mlops-platforms-to-compromise-ml-models-enterprise-data-lakes/
11 months ago
1
2
1
reposted by
Brett Hawkins
Catalin Cimpanu
11 months ago
IBM X-Force's Logan Goins has released Krueger, a .NET tool for remotely killing EDR using the Windows Defender Application Control (WDAC) utility
github.com/logangoins/K...
loading . . .
GitHub - logangoins/Krueger: Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC
Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC - logangoins/Krueger
https://github.com/logangoins/Krueger
0
25
8
reposted by
Brett Hawkins
Olaf Hartong
11 months ago
Detection Engineering is sometimes hard, and may fail. Still a lot of things can be learned by the process. In this blog I cover a lot. I had a detection, currently it's broken but MS is on it :D
medium.com/falconforce/...
loading . . .
Detection engineering rabbit holes — parsing ASN.1 packets in KQL
TL;DR: Detection engineering is sometimes hard. Your efforts may seem to have failed, but perseverance can pay off. Or you can still fail…
https://medium.com/falconforce/detection-engineering-rabbit-holes-parsing-asn-1-packets-in-kql-900902d1145d?source=friends_link&sk=4df5c02e1f194b72efc3c20b1e381408
0
6
5
reposted by
Brett Hawkins
Catalin Cimpanu
11 months ago
Secureworks Japan has released PyTune, a post-exploitation tool for enrolling fake devices into Microsoft Intune
www.blackhat.com/eu-24/briefi...
github.com/secureworks/...
loading . . .
Black Hat Europe 2024
Black Hat Europe 2024
https://www.blackhat.com/eu-24/briefings/schedule/index.html#unveiling-the-power-of-intune-leveraging-intune-for-breaking-into-your-cloud-and-on-premise-42176
0
39
18
@retbandit.bsky.social
and I are thrilled to be speaking
@shmoocon.bsky.social
in January on research we have been conducting on attacking and defending popular enterprise Machine Learning Operations (MLOps) platforms we see during adversary simulation engagements. Whitepaper and tool coming soon!
12 months ago
0
1
1
you reached the end!!
feeds!
log in