PenTestIT.com

Your source for Detection Engineering, Security Research and Adversary Simulation

Detection Engineering

The OpenAI Sophisticated Recording Device: Detection and Response – Part II

This is a continuation to my older post where I discuss about network and endpoint strategies to detect and respond to hardware implants.

Posted: by Leave a Comment

In my last post about the OpenAI sophisticated recording device, I stopped at general detection and response guidelines for covert devices that do not transmit. This post deals with the logical next step when such espionage devices have exfiltration capabilities and are now on your Microsoft Windows/Linux/Apple Mac server endpoints. There can be a variant where some one "pulls" Read more about The OpenAI Sophisticated Recording Device: Detection and Response – Part

Detection Engineering

The OpenAI Sophisticated Recording Device: Detection and Response – Part I

This is my post to help you in detection and response of the OpenAI recording device & similar devices when connected to an endpoint.

Posted: by Leave a Comment
Updated:

I came across the now viral OpenAI Newsroom post on X where an OpenAI engineer accused of planting a sophisticated recording device in an executive conference room. The device was a Seeed Studio XIAO ESP32-S3 Sense that was plugged into a USB port on the back of a TV. I missed the "back of a TV" part earlier and wrote this post with a endpoint - Microsoft Windows/Linux/Apple Read more about The OpenAI Sophisticated Recording Device: Detection and Response – Part

Cyber Threat Intelligence

Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

This blog is my interpretation of the Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

Posted: by Leave a Comment
Updated:

Microsoft released this months bulletin a tad bit late. Nontheless, here it is! I half expected a crazy announcement - but fortunately other than crossing the total number of CVEs mitigated compared to the whole of 2025 - this release is nothing exceptional. This month, Microsoft patched 1,413 CVEs this month, plus one republished Cisco Talos CVE. Microsoft Windows alone Read more about Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

Offensive Security

Finding crown jewels in Nmap scans with Jev!

This post details a tool I wrote to use the Jev detection model and create attack paths from nmap scans.

Posted: by Leave a Comment

Continuing my decision model journey with Jev. We know that an Nmap scan tells you what ports are open. It does not tell you which of these hosts matter. You may find a vCenter console, a Jenkins server, and the company blog can all look the same from the outside: TCP 443 or 8443, a TLS certificate, a web page. Typical attack path tools need a distinction before they can do Read more about Finding crown jewels in Nmap scans with Jev!

Cyber Threat Intelligence

Introduction: Jev From A Security Practioner’s Perspective

This post introduces The TypeSafe AI Jev model and my perspectives as a security practitioner.

Posted: by

I know I'm a tad bit late with this post, but work took over and this post about the introduction to Jev stayed in drafts over two weeks. However, now, we are ready to go! TypeSafe AI released Jev on September 15, 2026. It's the first of what they call "System One" models. You don't chat with it, you just send it a state (text or JSON) and a set of typed questions, and it Read more about Introduction: Jev From A Security Practioner’s Perspective

Cyber Threat Intelligence

Analysis: CVE-2026-88771 and CVE-2026-88772

This is my analysis of the Citrix NetScaler ADC/Gateway CVE-2026-88771 & CVE-2026-88772 vulnerabilities along with hunting & detection guide

Posted: by
Updated:

Citrix published fixes for eight NetScaler ADC and Gateway CVEs today - September 27, 2026, in bulletin CTX697096. Two of them, CVE-2026-88771 and CVE-2026-88772, were exploited before the bulletin went out. As a result, CISA added both to KEV the same day. This is my analysis of the two vulnerabilities, collation of data from multiple sources and the steps you can take to Read more about Analysis: CVE-2026-88771 and CVE-2026-88772

Offensive Security

Analysing BigDiskBuster, the Microsoft Defender Update Blocker

This is my analysis of the BigDiskBuster - the open source Microsoft Defender Update Blocker.

Posted: by
Updated:

Last week Nightmare Eclipse open sourced BigDiskBuster - although I can see that now all the repositories have been made private. This post is my analysis of this tool that many news outlets called a "0day" initially. In reality, it is a class of defense-evasion tools that never touches a security product - Windows Defender in this case. It does not involve a driver unload, or Read more about Analysing BigDiskBuster, the Microsoft Defender Update Blocker

Cyber Threat Intelligence

Claude Skill: threat-report-killchain

This post documents the features and working of a Claude skill that helps you automatically triage evidence backed threat intel reports.

Posted: by
Updated:

Everyday when I come across a threat intelligence report, I have to sift through a lot of data to get to the gist of it. Hence, I created this "threat-report-killchain" Claude skill to automate the process of CTI report triage for me. It does so completely, well 80% to be precise. Since, it helped me a lot, I thought of open sourcing it for the community. This post describes Read more about Claude Skill: threat-report-killchain

Cyber Threat Intelligence

Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

This blog is my interpretation of the Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

Posted: by
Updated:

Back after a hiatus the Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority blog. Last time I did this was Microsoft Patch Tuesday March 2026 Exploitability and Patching Priority. This time around, I am doing two things differently. I am ranking every priority against CISA BOD 26-04. Interested? Read on! Read more about Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

Cyber Threat Intelligence

Claude Skill: cve-check

This post describes a Claude Skill named cve-check that I wrote to enrich CVE information for threat intelligence collection

Posted: by
Updated:

If you follow me on LinkedIn, I released this skill there first. Resharing here if you don't. I created the cve-check Claude Skill to resolve multiple searches to begin my vulnerability mitigation research . The skill automates and presents multiple prerequisites that help you prioritize your threat detection backlog. Read on for more details. Read more about Claude Skill: cve-check

Detection Engineering

Essential Detection Engineering Metrics

This is a list of essential detection engineering metrics.

Posted: by
Updated:

You have prioritized your threat detection backlog, but now want to quantify the progress. Throughout my career leading multiple threat detection engineering teams, I have relied on well-defined metrics to measure outcomes, demonstrate program value, and drive continuous improvement. In this post, I outline the detection engineering metrics I consider most important, spanning Read more about Essential Detection Engineering Metrics

Detection Engineering

“Severity” or “Expected Severity” for Prioritization?

This post introduce the concept of "Expected Severity" for threat prioritization.

Posted: by 763 views
Updated:

In one of my last post - Prioritizing a Threat Detection Backlog, I talked about prioritizing your threat detection backlog. It is true when you run a program in an organization. However, when you consume security content from another organization, severity is often generalized. This is where, the concept of expected severity can help and I trust should be used more often. Let Read more about “Severity” or “Expected Severity” for Prioritization?