Blog

One of the most important things in a red teamer’s job is evidence. If you can’t demonstrate impact and make a risk real, it’s as

I’ve had several folks ask about Linux targets with Cobalt Strike 3.0 and later. Beacon is a Windows-only payload. The big question becomes, how do

In 2011, I was invited to Austin, TX by the local ISSA and OWASP chapters to teach a class on Armitage and the Metasploit Framework.

It’s CCDC season again. CCDC is the National Collegiate Cyber Defense Competition. Teams of students in 10 regions run simulated business networks and defend against red

There are a lot of people who talk about threat emulation. Use our super-duper-elitesy-neatsy-malware to emulate these tactics in your network. I say stuff like

There are several research projects to collect raw data from red team activity, process this data, and try to turn it into information. In this

I’d like to call your attention to the humble runas.exe program on Windows. This program allows a Windows user to spawn another program with another

During a recent conversation, a friend had mentioned that they saw Cobalt Strike as a post-exploitation only tool. This strikes me as a little odd.