PenTestIT.com

Your source for Detection Engineering, Security Research and Adversary Simulation

You are here: Home / Archives for Sigma

Detection Engineering

The OpenAI Sophisticated Recording Device: Detection and Response

This is my post to help you in detection and response of the OpenAI recording device & similar devices when connected to an endpoint.

Posted: by Leave a Comment

I came across the now viral OpenAI Newsroom post on X where an OpenAI engineer accused of planting a sophisticated recording device in an executive conference room. The device was a Seeed Studio XIAO ESP32-S3 Sense that was plugged into a USB port on the back of a TV. I missed the "back of a TV" part earlier and wrote this post with a endpoint - Microsoft Windows/Linux/Apple Read more about The OpenAI Sophisticated Recording Device: Detection and Response

Cyber Threat Intelligence

Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

This blog is my interpretation of the Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

Posted: by Leave a Comment
Updated:

Microsoft released this months bulletin a tad bit late. Nontheless, here it is! I half expected a crazy announcement - but fortunately other than crossing the total number of CVEs mitigated compared to the whole of 2025 - this release is nothing exceptional. This month, Microsoft patched 1,413 CVEs this month, plus one republished Cisco Talos CVE. Microsoft Windows alone Read more about Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

Offensive Security

Analysing BigDiskBuster, the Microsoft Defender Update Blocker

This is my analysis of the BigDiskBuster - the open source Microsoft Defender Update Blocker.

Posted: by
Updated:

Last week Nightmare Eclipse open sourced BigDiskBuster - although I can see that now all the repositories have been made private. This post is my analysis of this tool that many news outlets called a "0day" initially. In reality, it is a class of defense-evasion tools that never touches a security product - Windows Defender in this case. It does not involve a driver unload, or Read more about Analysing BigDiskBuster, the Microsoft Defender Update Blocker