Marat Nigmatullin retweeted
Henri Hambartsumyan took the artisanal approach of manually reverse engineering the small Windows binary werfault.exe. He wrote down his findings in this new blog. Hope this helps SOC analysts and incident responders with incidents involving werfault.exe. falconforce.nl/dissecting-wer…
0
6
13
699
Marat Nigmatullin retweeted
🚨 BLOG ALERT 🚨
The #DetectionEngineering maintenance series continues!
As a detection engineer, the real challenge is keeping your detections effective, tuned, and maintainable as your environment evolves.
That’s exactly what we explore in the third post of the series: #FalconDash, a tuning companion designed to help detection engineers understand, prioritize, and review their detections.
If you’re building and maintaining detections, this is worth a look.
medium.com/falconforce/in…
#ThreatDetection #BlueTeam #CyberSecurity #ThreatHunting #SOC
The #DetectionEngineering maintenance series continues!
As a detection engineer, the real challenge is keeping your detections effective, tuned, and maintainable as your environment evolves.
That’s exactly what we explore in the third post of the series: #FalconDash, a tuning companion designed to help detection engineers understand, prioritize, and review their detections.
If you’re building and maintaining detections, this is worth a look.
medium.com/falconforce/in…
#ThreatDetection #BlueTeam #CyberSecurity #ThreatHunting #SOC
0
3
2
270
Marat Nigmatullin retweeted
Detection performance shouldn’t be buried across alerts and metrics. 📊
In our latest blog, we introduce and open-source #FalconDash - a modular dashboard built to make Microsoft Sentinel detection performance visible, explorable, and easier to tune. 🚀 falconforce.nl/introducing-fa…
In our latest blog, we introduce and open-source #FalconDash - a modular dashboard built to make Microsoft Sentinel detection performance visible, explorable, and easier to tune. 🚀 falconforce.nl/introducing-fa…
0
12
35
8,263
Marat Nigmatullin retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/0…
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/0…
7
160
450
34,606
Marat Nigmatullin retweeted
Had a blast working with my buddy @max__grim creating this badge! Thanks to @OutflankNL and @MDSecLabs for the conf. It was a blast again ❤️ Looking forward to the next one!
1
4
30
1,101
Another great RedTreat! Awesome new location and great talks as always. Was really good to catch up with old friends and meet some new ones too.
Thanks @StanHacked, @domchell and @MarcOverIP for putting it all together!
And thanks @CyberSummoner and @max__grim for the badge 🕹️
Thanks @StanHacked, @domchell and @MarcOverIP for putting it all together!
And thanks @CyberSummoner and @max__grim for the badge 🕹️
1
0
10
521
Marat Nigmatullin retweeted
New blog: I’m in your logs now: deceiving analysts and blinding EDRs
Based on my BlackHat talk from last year, so you don't have to listen to my voice ;) Some exploration into ETW spoofing and buffer pool exhaustion.
medium.com/falconforce/im…
#FalconForce #ETW #EDR #Evasion
Based on my BlackHat talk from last year, so you don't have to listen to my voice ;) Some exploration into ETW spoofing and buffer pool exhaustion.
medium.com/falconforce/im…
#FalconForce #ETW #EDR #Evasion
3
74
258
16,461
A bit late to the party, but the recording of my SOCON talk about CyberArk PAM has been up on YouTube for a while now:
youtu.be/AsKCTlSA15M?is…
youtu.be/AsKCTlSA15M?is…
0
1
3
297
Marat Nigmatullin retweeted
In a few weeks it is time! Looking forward to meet everyone joining. There are still tickets available @BlackHatEvents to those interested.
blackhat.com/us-26/training…
Very excited to facilitate this training!
blackhat.com/us-26/training…
Very excited to facilitate this training!
Next August, we'll host our newly designed advanced defensive engineering training at @BlackHatEvents in Las Vegas.
Next to detection engineering we'll also cover many important defensive security topics like enrichment, lifecycle management and AI.
blackhat.com/us-26/training…
0
4
21
2,602
Marat Nigmatullin retweeted
Next august, we'll host our newly designed advanced defensive engineering training at @BlackHatEvents in Las Vegas. Next to detection engineering we'll also cover topics like enrichment, lifecycle management and AI. There are still some spot left!
blackhat.com/us-26/training…
blackhat.com/us-26/training…
0
10
19
4,167
Marat Nigmatullin retweeted
Last week, we joined @SpecterOps' SO-CON conference in Arlington, US. It has been an exciting week, with two FalconForce presentations on stage from @_mnigma_ and @olafhartong .
We look back at a great time at SO-CON!
We look back at a great time at SO-CON!
0
1
1
334
Marat Nigmatullin retweeted
CyberArk is built to protect your crown jewels, but what if it becomes the attack path?
@_mnigma_ shows how misconfigurations in PVWA & CCP can be abused to extract credentials and escalate privileges in just a few steps. #SOCON2026
@_mnigma_ shows how misconfigurations in PVWA & CCP can be abused to extract credentials and escalate privileges in just a few steps. #SOCON2026
0
1
14
1,447
In one week I will be presenting at @SpecterOps SO-CON 2026 about CyberArk PAM. I will share our practical experience and insights on PVWA edge cases and CCP API misconfigurations. #SOCON2026
More information and registration: specterops.io/so-con/
More information and registration: specterops.io/so-con/
0
5
12
1,909
Marat Nigmatullin retweeted
FalconForce is proud to be part of @SpecterOps' SO-CON conference in April.
And this year, there’s not one but two FalconForce talks at #SOCON!
More information and registration: specterops.io/so-con/
And this year, there’s not one but two FalconForce talks at #SOCON!
More information and registration: specterops.io/so-con/
0
3
7
1,026
Marat Nigmatullin retweeted
At FalconForce, we are always looking to enhance our detection engineering practices. In our latest #FalconFriday blog, we present the applied research that was done and our observations on near-real-time (NRT) analytic rules in practice: falconforce.nl/falconfriday-n…
0
4
4
1,454
Marat Nigmatullin retweeted
New year, new training dates! First stop of the year will be at @1ns0mn1h4ck, March 16-18 in Lausanne, Switzerland. Tickets for my Entra ID class are now on sale. More info and registration: insomnihack.ch/workshops/offe…
2
14
38
7,594
Marat Nigmatullin retweeted
Happy New Year! 2026 has started and we are eager to share with you our ambitions for this brand-new year.
Read the full post: linkedin.com/feed/update/ur…
Read the full post: linkedin.com/feed/update/ur…
1
3
5
1,496
Thrilled to speak at @SpecterOps SO-CON 2026! 🔥 Expect to learn about CyberArk PVWA edge cases & common CCP API misconfigurations to access "hidden" secrets: "4 GET requests = 3 Domain Admins – CyberArk magic you didn't know." #SOCON2026
FalconForce is proud to be part of @SpecterOps' SO-CON conference in April 2026. @_mnigma_ will present a talk on abusing misconfigurations in #CyberArk to get high privileges: “4 Get requests = 3 Domain admins: CyberArk magic you didn’t know about”.
specterops.io/so-con/
0
0
2
197
Marat Nigmatullin retweeted
#MDE custom collection is finally in public preview! It's a centrally managed solution to improve visibility and detection opportunities.
We're releasing a management tool and rule repository in YAML format to share new rules with the community.
medium.com/falconforce/mi…
We're releasing a management tool and rule repository in YAML format to share new rules with the community.
medium.com/falconforce/mi…
5
43
165
30,013
Marat Nigmatullin retweeted
Back in July, Neeraj Gupta introduced DeepPass2, a smarter secret scanner that finds both API keys/tokens & contextual passwords using BERT + LLM validation.
The model & tool code are now live!
Model ➡️ ghst.ly/3KTLkmm
Code ➡️ ghst.ly/3L96jS5
🧵: 1/2
The model & tool code are now live!
Model ➡️ ghst.ly/3KTLkmm
Code ➡️ ghst.ly/3L96jS5
🧵: 1/2
2
15
47
10,242