Proud Husband to @sgowens0716 and Father | Offensive Security Engineer | https://xitter.cf/t.co/CQv4PZcuvG
Charlotte, NC
Joined April 2013
- Tweets1.1K
- Following647
- Followers2.8K
- Likes6.3K
Cedric Owens retweeted
Alright here’s a new blog post for a new macOS malware by @AdamJKohler and I!
This was a fun one to reverse: stripped, encoded strings, persistence, and more :)
Enjoy!!
blog.kandji.io/malware-cucko…
Cedric Owens retweeted
What have I been doing recently? Working on a 100% automated attack simulation framework for Microsoft Defender 🛡️ called M0rphy (named after Paul Morphy the chess genius) that supports both Linux, macOS and Windows, as well as accidently finding some vulns while doing so!
Cedric Owens retweeted
🆕🍎My new blogpost @KandjiMDM about how Apple attempts to mitigate some installer script vulnerabilities using "Install Script Actions" and "Install Script Mutations" in the PackageKit framework.
blog.kandji.io/apple-mitigat…
Cedric Owens retweeted
🔊 New blog post about impersonating TCC permissions via Electron apps on macOS Sonoma
wojciechregula.blog/post/ele…
Cedric Owens retweeted
Short post where I revisit NPM payloads on macOS. medium.com/@D00MFist/loads-o…
Cedric Owens retweeted
Mythic just got an update! ✨
Check out @its_a_feature_'s latest blog post for a rundown of the updates made in Mythic v3.2, including:
✅ Push C2
✅ Interactive Async Tasking
✅ Dynamic File Browser
Read more! ghst.ly/46zRFsg
Cedric Owens retweeted
Dropping a quick blog post with a few videos walking through a review of how Gatekeeper looks up Notarization tickets! Calling the endpoint yourself is super quick.
swiftly-detecting.notion.sit…
Cedric Owens retweeted
💺 SwiftBelt
A macOS enumeration tool
Stealthy: uses Swift instead of CLI tools, avoids pop-ups
Checks:
* Full disk access
* Presence of security tools
* Searches for SSH and cloud creds
* Browser history
* Slack cookies
+ more
By @cedowens #redteam
github.com/cedowens/SwiftBel…
Cedric Owens retweeted
I put all my slides, whitepapers, workbooks, etc... for all of my past workshops and talks on my blog and added links for recordings where available. Now it's all available in a single space.
theevilbit.github.io/talks/
Cedric Owens retweeted
🎉🥁 The wait is over. Please welcome "Dock Tile Plugins" to the persistence club. My new favorite. 🤩 In the blog:
🍎 background and details
🍎 how to create and use
🍎 how to detect
🍎 sample code and binary
theevilbit.github.io/beyond/…
Cedric Owens retweeted
My Okta for Red Teamers post is up! We look at how Kerberos SSO works, how to intercept credentials via a fake AD Agent, decrypting AD Agent tokens, adding skeleton key's, and even how to deploy a janky SAML IdP server to auth as any user for good measure. trustedsec.com/blog/okta-for…
Cedric Owens retweeted
During a @Fox0x01 training, Tom found stack smashing protection was broken for GCC AArch64 under a certain (not uncommon) condition.
GCC + Arm have fixed it, but lots of exploitable overflows will remain compiled in the wild.
Sometimes it is the compiler!
rtx.meta.security/mitigation…
Cedric Owens retweeted
If you missed the BSidesLV talk @AdamTheAnalyst and I gave on TTPForge last week, you're in luck! It's already on youtube, enjoy: youtu.be/H9YqJ1Ry1l8?t=978
Cedric Owens retweeted
Introducing RogueSliver. A tool to disrupt offensive campaigns that use the Sliver C2 framework.
• Hijack beacons
• Send memes to the attacker
• Flood C2 servers
#DFIR #RedTeam
github.com/ACE-Responder/Rog…
Cedric Owens retweeted
Are you interested in getting involved with a meaningful opensource project? We've still got plenty of work to do on LOOBins. If you're interesting in contributing, check out the backlog here (labeled w/ help wanted):
github.com/infosecB/LOOBins/…
Cedric Owens retweeted
🃏 Stay informed about this macOS enterprise threat 🍎 Key components and indicators of JokerSpy reveal an active adversary deploying novel spyware, cross-platform backdoors, and open-source reconnaissance to compromise organizations with macOS devices.
sentinelone.com/blog/jokersp…
Cedric Owens retweeted
The new campaign article on JOKERSPY aims to help you understand the recently discovered intrusion around REF9134. See how #ElasticSecurityLabs identified the adversary’s movements: go.es.io/3NDh3Hh
