Matt Nelson

@enigma0x3

Security Researcher & Operator | Enjoys abusing features | Tweets are my own |

Indianapolis, IN
enigma0x3.net
Joined January 2011
72 Photos and videos Photos and videos

Tweets

You blocked @enigma0x3

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @enigma0x3

  1. Pinned Tweet
    Sep 11

    [Blog] Lateral Movement using Excel.Application and DCOM

    8 replies 571 retweets 810 likes
  2. Retweeted
    20 hours ago

    Another instance where encourages us to rethink our views on digital signature validation.

    92 retweets 156 likes
  3. Retweeted
    23 hours ago

    How sure are you that "(Verified) Microsoft Windows" refers to a program that actually originates from Microsoft? Code Signing Certificate Cloning Attacks and Defenses

    2 replies 193 retweets 330 likes
  4. Retweeted
    Dec 21

    UPDATE: If you clean install RS4+ and have compatible hardware VBS/HVCI is now automatically enabled!! This means the Windows kernel now enforces by default: Kernel code integrity, runtime ACG, and control flow integrity via VBS. Huge for Windows security. Checkout WIP builds!

    This is HUGE. Kernel Control Flow Guard, HVCI, Hyper Guard and bunch of other goodness are now available on non-Enterprise Windows SKUs. Turn it on, now.
    Show this thread
    9 replies 173 retweets 270 likes
  5. Retweeted
    Dec 21

    [Get-Doppelgangers] - Powershell script to detect process and dll doppelganging thx for the poc!

    163 retweets 253 likes
  6. Retweeted
    Dec 20

    Did you know can patch RDP server to allow multiple simultaneous sessions, workstations or servers? 🙃 (because some people do not like the command line 😉)

    6 replies 300 retweets 529 likes
  7. Retweeted
    Dec 19
    Replying to

    Easy. Try to become an expert at something and blog about your experience and demonstrate how what you learned has real-world applicability. But mainly what I look for in junior people is drive, passion, and proof of attempts to tackle challenges.

    2 replies 3 retweets 9 likes
  8. Retweeted
    Dec 19

    I often get asked, "How do I get started in malware RE?" Quite a while ago I was working on some tutorials until I saw these by Just read those for a solid start.

    10 replies 330 retweets 866 likes
  9. Retweeted
    Dec 19

    We've open sourced our framework for developing alerting and detection strategies for incident response. We have also included several internal strategies as examples to spur greater sharing and collaboration with defenders.

    10 replies 245 retweets 456 likes
  10. Retweeted
    Dec 18

    Do you know how to get cleartext passwords of users, at logon, in a Windows 10? Especially with Credential Guard enabled? - It's easy as an Authentication Package (mimilib) or a piece of code injected...

    5 replies 537 retweets 828 likes
    Show this thread
    Show this thread
  11. Retweeted
    Dec 18

    Project Zero blog: "aPAColypse now: Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript" by , , and -

    8 replies 561 retweets 700 likes
  12. Retweeted
    Dec 16

    How to reverse engineer without knowing how to reverse engineer: IDA pro 2. Hit shift+f12 for the strings view 3. Choose an interesting string 4. Hit x and go over the xrefs 5. You are now earning at least $140K a year. Bonus: say that you can code html

    26 replies 524 retweets 1,627 likes
  13. Retweeted
    Dec 16

    Facebook Security is proud to announce that we are offering a free twelve-week hands-on course for veterans who desire to get into cybersecurity. Please make sure to apply by January 16th!

    98 replies 2,428 retweets 3,127 likes
    Show this thread
    Show this thread
  14. Retweeted
    Dec 11

    Cobalt Strike 3.10 – Хакер vs. 肉雞

    6 replies 98 retweets 154 likes
  15. Retweeted
    Dec 15

    Are you really ready for ? What does your data look like? Data Availability != Data Quality

    3 replies 122 retweets 197 likes
  16. Retweeted
    Dec 13

    Everybody needs to read 's presentation on OLE: The attack surface of MS Office is a factor of EVERY (COM-installing) application installed on your PC! It's like the early days of IE6 ActiveX all over again...

    6 replies 120 retweets 226 likes
  17. Dec 13

    lol, classy

    3 replies 5 retweets 19 likes
  18. Retweeted
    Dec 12

    A Word DDE defense in depth change for you - . Disables auto-update for any linked fields, including DDE.

    3 replies 52 retweets 77 likes
  19. Retweeted
    Nov 22

    I really enjoy reviewing referrer logs...

    2 replies 7 retweets 24 likes
  20. Nov 21

    Sure enough, "aaResources.dll" (and aaLoader.dll) are signed by "Amazon Services LLC" on 10/4/2017. Weirdest use of an HTA I have seen. ¯\_(ツ)_/¯¯

    3 retweets 12 likes
    Show this thread
    Show this thread
  21. Nov 21

    Seriously, .

    4 replies 24 retweets 86 likes
    Show this thread
    Show this thread

@enigma0x3 hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·