Dwyer
@_Dwyer_
Threat research is the name of my game. I know enough to know that I have a lot to learn. opinions are my own
my boy's wicked smart
Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been working on for the past couple months. This dives into DCOM Interfaces that enable remote ETW trace sessions without dropping an agent to disk. Includes a detailed…
I had a great time replicating this exploit and even tho it’s being used for bad stuff you gotta appreciate the elegance of vuln chaining. However, we can’t ignore that while the vulns change the outcomes remain the same. binarydefense.com/resources/blog…
would you look at that...yet another zero day that can be detected by looking for the web enabled process spawning command interpreters.
RE: CVE-2025-47812 - Pretty please can everyone proactively put in detections looking for their web enabled processes spawning command interpreters. IR friends, I put together this repo of artifacts and log files a couple years ago that may help: github.com/TactiKoolSec/M…
Yooo you heading to @BSidesPGH ?!? Come find me and the @Binary_Defense team and let's catch up on all things threats, detections, and infosec community! PS - hit up table 20 for a chance to win a prize!
Dudes... please enable Detailed File Share auditing in your environment. All these attackers who switched over to the Impacket suite still run the default configs and it takes like 2 seconds to find them.
Detection Engineering team is growing. New job posting: recruiting.paylocity.com/Recruiting/Job…
CryptoJS is showing up in phishing kits more and more. But here's the good news, you don't have to be a reverse engineer to break them down. @_Dwyer_, Deputy CTO and head of ARC Labs, walks you through how to analyze these attacks like a pro. Because the more you understand…
Installing prereqs or setting up simulation platforms for detection engineering can be a pain when you just want some test data. Might as well make sure my C# skills don't disappear completely.
Nothing like listening to SRV while writing Python to really drive home how bad you are at things in one sitting.
I spent the last few days getting trashed by my coworkers for watching hoof trimming and car detailing videos to relax. I cannot be the only one!
This is becoming a thing. So much so that we're hosting a webinar to talk about what we're seeing in terms of EDR killers, bypasses, and silencers. binarydefense.com/resources/webi…
Another JS based Microsoft 365 credential harvesting campaign. Wanna learn how to analyze these yourself? Click the link binarydefense.com/resources/blog…
I'm not kidding, I really think that learning how to work with and manipulate CSV/JSON/XML data in Python and PowerShell is the most useful skill I've acquired in my career. 10/10 would recco.