Eric Sheesley
@esheesle.bsky.social
Infosec practitioner; Co-creator of the MITRE ATT&CK Framework
Mastodon: http://infosec.exchange/@esheesle
Mastodon: http://infosec.exchange/@esheesle
Reposted by Eric Sheesley
They're going to summon an old 386 with 2MB RAM through that portal, aren't they?
October 3, 2025 at 12:48 PM
They're going to summon an old 386 with 2MB RAM through that portal, aren't they?
Reposted by Eric Sheesley
filing this under the, "this is why we can't have nice things" folder...
Good lord:
"While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find."
"While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find."
One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens - dirkjanm.io
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin reading this, yes that means complete access to your tenant. The vulnerability consisted of two components: undocumented impersonation tokens that Microsoft uses in their backend for service-to-service (S2S) communication, called “Actor tokens”, and a critical vulnerability in the (legacy) Azure AD Graph API that did not properly validate the originating tenant, allowing these tokens to be used for cross-tenant access.
dirkjanm.io
September 17, 2025 at 5:44 PM
filing this under the, "this is why we can't have nice things" folder...
What are some must read books for infosec folks? Can be books to learn something, be better leaders or communicators, or even fiction. Just trying to get a good list built. Thanks in advance
August 28, 2025 at 1:38 PM
What are some must read books for infosec folks? Can be books to learn something, be better leaders or communicators, or even fiction. Just trying to get a good list built. Thanks in advance
Reposted by Eric Sheesley
The ATT&CKcon 6.0 talk lineup is now live! Check out our fabulous group of speakers, or pick up a ticket to join us October 14-15 in McLean, VA at na.eventscloud.com/attackcon6. Only able to join us virtually? Hang tight, virtual registration opens September 3rd.
August 26, 2025 at 5:06 PM
The ATT&CKcon 6.0 talk lineup is now live! Check out our fabulous group of speakers, or pick up a ticket to join us October 14-15 in McLean, VA at na.eventscloud.com/attackcon6. Only able to join us virtually? Hang tight, virtual registration opens September 3rd.
Reposted by Eric Sheesley
I am SO SICK of politicians railing against chemtrails.
When is someone going to address the leprechaun infestations?! Those little bastards keep creating rainbows just to support pride. It's just sickening how they lord over us with their wee pots of gold...
When is someone going to address the leprechaun infestations?! Those little bastards keep creating rainbows just to support pride. It's just sickening how they lord over us with their wee pots of gold...
Mace: I would support any action to remove fluoride from the water. And ban also chemtrails
August 6, 2025 at 11:07 PM
I am SO SICK of politicians railing against chemtrails.
When is someone going to address the leprechaun infestations?! Those little bastards keep creating rainbows just to support pride. It's just sickening how they lord over us with their wee pots of gold...
When is someone going to address the leprechaun infestations?! Those little bastards keep creating rainbows just to support pride. It's just sickening how they lord over us with their wee pots of gold...
Reposted by Eric Sheesley
Bonus Drop #84 (2025-05-31): Shop^w Infer Local With Context
Today's Bonus Drop discusses the integration of an MCP server within a local Ollama workflow for improved contextual inference.
It emphasizes the importance of model selection, favoring qwen2.5-coder for its performance + context.
Today's Bonus Drop discusses the integration of an MCP server within a local Ollama workflow for improved contextual inference.
It emphasizes the importance of model selection, favoring qwen2.5-coder for its performance + context.
Bonus Drop #84 (2025-05-31): Shop^w Infer Local With Context
Today’s Bonus Drop discusses the integration of an MCP server within a local Ollama workflow for improved contextual inference. It emphasizes the importance of model selection, particularly f…
dailydrop.hrbrmstr.dev
May 31, 2025 at 12:45 PM
Bonus Drop #84 (2025-05-31): Shop^w Infer Local With Context
Today's Bonus Drop discusses the integration of an MCP server within a local Ollama workflow for improved contextual inference.
It emphasizes the importance of model selection, favoring qwen2.5-coder for its performance + context.
Today's Bonus Drop discusses the integration of an MCP server within a local Ollama workflow for improved contextual inference.
It emphasizes the importance of model selection, favoring qwen2.5-coder for its performance + context.
Reposted by Eric Sheesley
On point
April 5, 2025 at 12:39 AM
On point
Reposted by Eric Sheesley
American farm exports were worth $179 billion in 2022
March 3, 2025 at 6:36 PM
American farm exports were worth $179 billion in 2022
Reposted by Eric Sheesley
The NYT has published a useful graphic showing all the agencies with investigations into or regulatory battles with of Musk's companies that have seen staffing cuts, including the firing of top officials.
https://www.nytimes.com/2025/02/11/us/politics/elon-musk-companies-conflicts.html
https://www.nytimes.com/2025/02/11/us/politics/elon-musk-companies-conflicts.html
February 11, 2025 at 6:49 PM
The NYT has published a useful graphic showing all the agencies with investigations into or regulatory battles with of Musk's companies that have seen staffing cuts, including the firing of top officials.
https://www.nytimes.com/2025/02/11/us/politics/elon-musk-companies-conflicts.html
https://www.nytimes.com/2025/02/11/us/politics/elon-musk-companies-conflicts.html
Reposted by Eric Sheesley
I just lost my job, along with most of my coworkers, due to the illegal grant freeze.
I worked at an organization that
-helped veterans who have lost a limb
-Assisted elderly and disabled people
-Helped hospitals better treat people who have lost limbs
I worked at an organization that
-helped veterans who have lost a limb
-Assisted elderly and disabled people
-Helped hospitals better treat people who have lost limbs
February 7, 2025 at 6:33 PM
I just lost my job, along with most of my coworkers, due to the illegal grant freeze.
I worked at an organization that
-helped veterans who have lost a limb
-Assisted elderly and disabled people
-Helped hospitals better treat people who have lost limbs
I worked at an organization that
-helped veterans who have lost a limb
-Assisted elderly and disabled people
-Helped hospitals better treat people who have lost limbs
Reposted by Eric Sheesley
I set up an Inoreader job to create an RSS feed from the White House exec order sub-site b/c there is no direct one.
I've re-published it so anyone can use it to keep an eye on EOs:
www.inoreader.com/stream/user/...
I've re-published it so anyone can use it to keep an eye on EOs:
www.inoreader.com/stream/user/...
https://www.inoreader.com/stream/user/1005406747/tag/47
<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
<title>47 via boB Rudis on Inoreader</title>
<...
www.inoreader.com
January 22, 2025 at 7:32 PM
I set up an Inoreader job to create an RSS feed from the White House exec order sub-site b/c there is no direct one.
I've re-published it so anyone can use it to keep an eye on EOs:
www.inoreader.com/stream/user/...
I've re-published it so anyone can use it to keep an eye on EOs:
www.inoreader.com/stream/user/...
Reposted by Eric Sheesley
You may not like it, but this is what peak performance looks like.
January 16, 2025 at 10:24 PM
You may not like it, but this is what peak performance looks like.
Reposted by Eric Sheesley
If you’re able to, please donate, but please follow their account on Bluesky for more info: @freeourfeeds.com
January 14, 2025 at 4:19 PM
If you’re able to, please donate, but please follow their account on Bluesky for more info: @freeourfeeds.com
Reposted by Eric Sheesley
We've had ATT&CKcon 5.0 videos and slides out for a bit now, but our conference archive page is also up now organizing them in one place. Check out all of this year's content, including Lightning and Couch talks or any previous ATT&CKcon.
attack.mitre.org/resources/at...
attack.mitre.org/resources/at...
MITRE ATT&CKcon - ATT&CKcon 5.0 | MITRE ATT&CK®
attack.mitre.org
January 13, 2025 at 2:37 PM
We've had ATT&CKcon 5.0 videos and slides out for a bit now, but our conference archive page is also up now organizing them in one place. Check out all of this year's content, including Lightning and Couch talks or any previous ATT&CKcon.
attack.mitre.org/resources/at...
attack.mitre.org/resources/at...
Reposted by Eric Sheesley
We're witnessing the evolution of ransomware.
Yesterday someone informed us of the existence of the new TTP of AWS S3 extortion. More specifically, Threat Actors abusing the Amazon Key Management Service (KMS) to encrypt company AWS buckets (or any cloud provider).
Yesterday someone informed us of the existence of the new TTP of AWS S3 extortion. More specifically, Threat Actors abusing the Amazon Key Management Service (KMS) to encrypt company AWS buckets (or any cloud provider).
January 8, 2025 at 2:07 AM
We're witnessing the evolution of ransomware.
Yesterday someone informed us of the existence of the new TTP of AWS S3 extortion. More specifically, Threat Actors abusing the Amazon Key Management Service (KMS) to encrypt company AWS buckets (or any cloud provider).
Yesterday someone informed us of the existence of the new TTP of AWS S3 extortion. More specifically, Threat Actors abusing the Amazon Key Management Service (KMS) to encrypt company AWS buckets (or any cloud provider).
Reposted by Eric Sheesley
4. 2025 is the only square year our generation will see. The next square year is 2116 A.D. (92 years away)
5. 2025 is also the product of two squares (9² × 5²) = 2025
6. 2025 is the sum of three squares
(40² + 20² + 5²) = 2025
What else?
5. 2025 is also the product of two squares (9² × 5²) = 2025
6. 2025 is the sum of three squares
(40² + 20² + 5²) = 2025
What else?
January 1, 2025 at 11:11 AM
4. 2025 is the only square year our generation will see. The next square year is 2116 A.D. (92 years away)
5. 2025 is also the product of two squares (9² × 5²) = 2025
6. 2025 is the sum of three squares
(40² + 20² + 5²) = 2025
What else?
5. 2025 is also the product of two squares (9² × 5²) = 2025
6. 2025 is the sum of three squares
(40² + 20² + 5²) = 2025
What else?
Reposted by Eric Sheesley
Remember to leave all your ports open tonight so Santa can leave you presents
December 24, 2024 at 8:00 AM
Remember to leave all your ports open tonight so Santa can leave you presents
Reposted by Eric Sheesley
Managed to get to Ocean City #Maryland to check out the holiday lights. One son was under the weather so chilled a lot in the hotel but still said he enjoyed the break from home. Lots of carry out food for us, but good break from life.
December 16, 2024 at 12:25 AM
Managed to get to Ocean City #Maryland to check out the holiday lights. One son was under the weather so chilled a lot in the hotel but still said he enjoyed the break from home. Lots of carry out food for us, but good break from life.
Reposted by Eric Sheesley
For anyone interested in detection and prevention methods against Salt Typhoon intrusions targeting communication providers, here is a comprehensive guide:
media.defense.gov/2024/Dec/03/...
media.defense.gov/2024/Dec/03/...
December 4, 2024 at 2:37 PM
For anyone interested in detection and prevention methods against Salt Typhoon intrusions targeting communication providers, here is a comprehensive guide:
media.defense.gov/2024/Dec/03/...
media.defense.gov/2024/Dec/03/...
Reposted by Eric Sheesley
I spoke to Alexis Alley from the CyberPeace Institute at the #thehaguebeyond125 about the cybersecurity challenges faced by nonprofits. #CommonGoodCyber @craignewmark.bsky.social @gca.bsky.social
“Nonprofits are in a uniquely bad position; they have data that is very valuable to attackers, but often lack the cybersecurity expertise to protect it.” - Common Good Cyber
Philip Reitinger, GCA´s President and CEO and leading representative of Common Good Cyber, spoke to Alexis Alley from the CyberPeace Institute at the Beyond 125 event in The Hague. Watch the video and...
commongoodcyber.org
December 4, 2024 at 11:52 AM
I spoke to Alexis Alley from the CyberPeace Institute at the #thehaguebeyond125 about the cybersecurity challenges faced by nonprofits. #CommonGoodCyber @craignewmark.bsky.social @gca.bsky.social
Today we give thanks for the ability to over eat. For those of us who are technically inclined and getting together with others, we also give thanks for any gathering that doesn't include "so I clicked this link and my computer is acting strange"
November 28, 2024 at 2:50 PM
Today we give thanks for the ability to over eat. For those of us who are technically inclined and getting together with others, we also give thanks for any gathering that doesn't include "so I clicked this link and my computer is acting strange"
Reposted by Eric Sheesley
For those using Bluesky (on Android) and missing the ability to resume timeline position when opening the app, I'd suggest trying Skywalker. Not perfect, but pretty darn good.
Skywalker (@skywalker.thereforeiam.eu)
Android app for Bluesky. Bookmarks, thread posting and more Created by @michelbestaat.thereforeiam.eu Get it from Google Play: https://play.google.com/store/apps/details?id=com.gmail.mfnboer.skywalker ☕️ https://buymeacoffee.com/skywalker.thereforeiam.eu
bsky.app
November 27, 2024 at 7:04 PM
For those using Bluesky (on Android) and missing the ability to resume timeline position when opening the app, I'd suggest trying Skywalker. Not perfect, but pretty darn good.
Reposted by Eric Sheesley
PSA
For those going home to visit family this weekend:
• Samsung calls it Auto Motion Plus
• LG calls it TruMotion
• Sony calls it Motionflow
• Roku calls it Action Smoothing
• Google TV calls it Motion Enhancement
• Vizio calls it Smooth Motion Effect.
• Samsung calls it Auto Motion Plus
• LG calls it TruMotion
• Sony calls it Motionflow
• Roku calls it Action Smoothing
• Google TV calls it Motion Enhancement
• Vizio calls it Smooth Motion Effect.
November 27, 2024 at 1:38 AM
PSA