Andrew
@4ndr3w6S
Followers
2K
Following
8K
Statuses
999
Senior Manager of Detection Engineering @HuntressLabs | Prev. Practice Lead, TAC (Purple Team) @TrustedSec | @SpursOfficial Super Fan - COYS!
Joined April 2017
Domain Controllers are not PAWs. Please DO NOT USE your Domain Controllers as “jump boxes” to other systems.
49
29
289
Incredibly excited to share my first blog with @HuntressLabs 🚀 I explore detecting Kerberoasting attacks using Perfmon as a data source—highlighting the rich metadata in Perfmon counters and their potential for enhancing detections. 😈 Check it out:
3
31
146
🌶️🌶️🌶️😈
For those unable to get their hands on EDR software for reversing, TrendMicro kindly publishes their resources at It's possible to download and extract the on-prem appliance and explore to understand how EDRs (if you can even call it that) work.
2
10
82
Reading a report that only has Active Directory based attacks…oh wait 🙃 🌶️😈
What's purple team? Wrong answers only.
0
0
2
This is a prime example of reading/learning code + learning internals (with rinse and repeat) 🦾 Fantastic read and writeup! 🔥
Join @olafhartong in his journey down the rabbit hole in search of new detection opportunities in the #Zeek telemetry embedded in Microsoft's EDR #MDE! Detection engineering is sometimes hard … 😎 #detectionengineering #kql #blueteam
1
1
11
Amazing work by my awesome colleagues @HuntressLabs 🔥 Check it out below, for the details on Cleo (CVE-2024-50623) 👇
0
0
6
@N7WEra @odiesec @Octoberfest73 @exploitph and I identified many of the flag differences 2 years ago, and baked them into our tool:
1
0
2
LOL sorry @gentilkiwi 😂😅
🚀 Exciting update for Haunt: it can now execute C# assemblies directly from memory! 🛡️ Enhancing covert operations and expanding capabilities. Huge thanks to my incredible Patreons for making this possible!
2
1
7
@techspence Burning tradecraft to phish your way in, only to realize you actually are in a pure Mac environment and there is no Active Directory 😂
1
0
5
0
0
3
0
0
3
Learning to code + Learning internals = 💜
There are some interesting detections for U2U/UnPAC the hash in certipy/rubues/mimiktaz/impacket based on TGS ticket options (. Did some tinkering and by removing a few flags you can shake detection while still recovering the NT hash from a TGT
0
0
7