PenTestIT.com

Your source for Detection Engineering, Security Research and Adversary Simulation

You are here: Home / Archives for MITRE ATT&CK

Offensive Security

Analysing BigDiskBuster, the Microsoft Defender Update Blocker

This is my analysis of the BigDiskBuster - the open source Microsoft Defender Update Blocker.

Posted: by Leave a Comment

Last week Nightmare Eclipse open sourced BigDiskBuster - although I can see that now all the repositories have been made private. This post is my analysis of this tool that many news outlets called a "0day" initially. In reality, it is a class of defense-evasion tools that never touches a security product - Windows Defender in this case. It does not involve a driver unload, or Read more about Analysing BigDiskBuster, the Microsoft Defender Update Blocker

Cyber Threat Intelligence

Claude Skill: threat-report-killchain

This post documents the features and working of a Claude skill that helps you automatically triage evidence backed threat intel reports.

Posted: by Leave a Comment
Updated:

Everyday when I come across a threat intelligence report, I have to sift through a lot of data to get to the gist of it. Hence, I created this "threat-report-killchain" Claude skill to automate the process of CTI report triage for me. It does so completely, well 80% to be precise. Since, it helped me a lot, I thought of open sourcing it for the community. This post describes Read more about Claude Skill: threat-report-killchain

Detection Engineering

Essential Detection Engineering Metrics

This is a list of essential detection engineering metrics.

Posted: by
Updated:

You have prioritized your threat detection backlog, but now want to quantify the progress. Throughout my career leading multiple threat detection engineering teams, I have relied on well-defined metrics to measure outcomes, demonstrate program value, and drive continuous improvement. In this post, I outline the detection engineering metrics I consider most important, spanning Read more about Essential Detection Engineering Metrics

Offensive Security

List of Open Source C2 Post-Exploitation Frameworks

This is a list of open source C2 post-exploitation frameworks.

Posted: by 1,307 views
Updated:

Restoring this post with the help of the Wayback machine - This post has been lying in my drafts for more than a year with edits all over. But two days ago, it was announced that Powershell Empire would no longer be supported by it’s authors. Hence just like I curated a list of adversary emulation tools, I finalized this list of open source C2 post-exploitation Read more about List of Open Source C2 Post-Exploitation Frameworks

Adversary Emulation

List of Adversary Emulation Tools

This is a list of open source and commercial adversary emulation tools

Posted: by 1,266 views
Updated:

As I went through the logs on this blog, I saw that an old post from 2018 was still being requested for! Thanks to the internet gods, I was able to find a cached copy. Currently, this is a paste of the old adversary emulation post as is. But, I will update it in a few days time. Every once in a while, the security industry brings forth a new buzz word and introduces Read more about List of Adversary Emulation Tools