Gavin K

@atomiczsec

building and breaking @SpecterOps | opinions are my own

atomiczsec.net

Joined August 2021

Replies Reposts Media

Pinned
Gavin K
@atomiczsec
Aug 12
‼️new tradecraft release: I am publishing Blacklight with @SpecterOps, an open-source toolkit and blog for mapping and analyzing the local attack surface created by AI agents on endpoints local agents are becoming apart of everyday workflows and they leave behind a growing set
2
Gavin K
@atomiczsec
Aug 31
fun weekend experiment, trying to control Windows Event Logs and their channels through a BOF...it went pretty well: ✅released event_log_manage which can inspect create write clear destroy event files, useful for defense evasion* or command and control The idea from
2
Gavin K
@atomiczsec
Aug 15
man cursor has been around for a while
Gavin K
@atomiczsec
Aug 15
there is a lot data agents are making on endpoints for both defenders and attackers, @0x4D31's Endpoint Agent Abuse repo is taxonomizing this new attack surface. Blacklights TTPs have been added here, I will be referencing this repo for tradecraft discovery and tracking updates
1
Gavin K
@atomiczsec
Jul 15
this note is applicable to a lot of fields; I really resonate with these two quotes from doing security as a hobby to moving it into a career: "the things i used to do at night, after school, after work, in the margins of life, somehow became the center of my life" and when it
Ryo Lu
@ryolu_
Jul 14
when the dream becomes the job i used to think the dream was to make my hobby my work. to spend my life close to the things i loved: computers, tools, interfaces, systems, tiny details, the feeling of making something from nothing. the things i used to do at night, after
1