Matt Nelson

@enigma0x3

Security Researcher & Operator | Enjoys abusing features | Tweets are my own |

Indianapolis, IN
Joined January 2011

Tweets

You blocked @enigma0x3

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @enigma0x3

  1. Pinned Tweet
    Sep 11
  2. Retweeted
    20 hours ago

    Another instance where encourages us to rethink our views on digital signature validation.

  3. Retweeted
    23 hours ago

    How sure are you that "(Verified) Microsoft Windows" refers to a program that actually originates from Microsoft? Code Signing Certificate Cloning Attacks and Defenses

  4. Retweeted
    Dec 21

    UPDATE: If you clean install RS4+ and have compatible hardware VBS/HVCI is now automatically enabled!! This means the Windows kernel now enforces by default: Kernel code integrity, runtime ACG, and control flow integrity via VBS. Huge for Windows security. Checkout WIP builds!

  5. Retweeted
    Dec 21

    [Get-Doppelgangers] - Powershell script to detect process and dll doppelganging thx for the poc!

  6. Retweeted

    Did you know can patch RDP server to allow multiple simultaneous sessions, workstations or servers? 🙃 (because some people do not like the command line 😉)

  7. Retweeted
    Dec 19
    Replying to

    Easy. Try to become an expert at something and blog about your experience and demonstrate how what you learned has real-world applicability. But mainly what I look for in junior people is drive, passion, and proof of attempts to tackle challenges.

  8. Retweeted
    Dec 19

    I often get asked, "How do I get started in malware RE?" Quite a while ago I was working on some tutorials until I saw these by Just read those for a solid start.

  9. Retweeted
    Dec 19

    We've open sourced our framework for developing alerting and detection strategies for incident response. We have also included several internal strategies as examples to spur greater sharing and collaboration with defenders.

  10. Retweeted

    Do you know how to get cleartext passwords of users, at logon, in a Windows 10? Especially with Credential Guard enabled? - It's easy as an Authentication Package (mimilib) or a piece of code injected...

    Show this thread
  11. Retweeted
    Dec 18

    Project Zero blog: "aPAColypse now: Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript" by , , and -

  12. Retweeted
    Dec 16

    How to reverse engineer without knowing how to reverse engineer: IDA pro 2. Hit shift+f12 for the strings view 3. Choose an interesting string 4. Hit x and go over the xrefs 5. You are now earning at least $140K a year. Bonus: say that you can code html

  13. Retweeted
    Dec 16

    Facebook Security is proud to announce that we are offering a free twelve-week hands-on course for veterans who desire to get into cybersecurity. Please make sure to apply by January 16th!

    Show this thread
  14. Retweeted
    Dec 11
  15. Retweeted
    Dec 15

    Are you really ready for ? What does your data look like? Data Availability != Data Quality

  16. Retweeted
    Dec 13

    Everybody needs to read 's presentation on OLE: The attack surface of MS Office is a factor of EVERY (COM-installing) application installed on your PC! It's like the early days of IE6 ActiveX all over again...

  17. Dec 13
  18. Retweeted
    Dec 12

    A Word DDE defense in depth change for you - . Disables auto-update for any linked fields, including DDE.

  19. Retweeted
    Nov 22

    I really enjoy reviewing referrer logs...

  20. Nov 21

    Sure enough, "aaResources.dll" (and aaLoader.dll) are signed by "Amazon Services LLC" on 10/4/2017. Weirdest use of an HTA I have seen. ¯\_(ツ)_/¯¯

    Show this thread
  21. Nov 21
    Show this thread

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·