CTI Analyst | Threat Hunter
based in europe
Opinions are my own
| bsky.app | https://bsky.app/profile/intuentis0x0.bsky.social |
| https://www.reddit.com/user/intuentis0x0/ | |
| Medium | https://medium.com/@intuentis0x0 |
| x | https://x.com/intuentis0x0 |
@badsectorlabs thanks for the work all the time. It was always fun and highly appreciated to have the new LWiS.
Source: https://blog.badsectorlabs.com/taking-a-break-2026-04-06.html
lol https://seclists.org/oss-sec/2026/q1/89
telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.
If the client supply a carefully crafted USER environment value being the string "-f root", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes
In telnetd for a decade 💀
Come over this pretty interesting arcticel about Windows Defender Application Control (WDAC) policies to disable EDR agents. Very interesting. Also the first research regading this is worth a look.
https://beierle.win/2025-08-28-A-Nightmare-on-EDR-Street-WDACs-Revenge/
This article does a good job of explaining why CTI isn't just for blue teams and why red teams can also benefit from good CTI analysts. I agree with many (though not all) of the points made here. CTI for red teams is a topic that’s discussed far too rarely.
This tool deserves the naming of a "swiss army knife".
Kevin Beaumont
Inspirational Skeletor💀
The DFIR Report
cR0w 
