Mike Manrod (@CroodSolutions) / X

Mike Manrod

11.9K posts

Mike Manrod

@CroodSolutions

CISO and faculty by day, adversary emulation/tools by night, bad jokes and memes all the time.

Arizona, USA

Joined June 2021

Pinned
Mike Manrod
@CroodSolutions
May 25
For those who answered "What is ClickFix" here is a short video including a demo and walk-through. And, for those who answered indicating they are thinking about doing ClickFix penetration tests, this video provides a demo of BeaconatorC2 payloads that will give you a jump-start
8.5K
Mike Manrod
@CroodSolutions
Jul 19, 2024
So - who else is having massive BSOD with devices running Crowdstrike on Windows (csagent.sys)? Any insight if this is adversary activity or is it is just a bad update or something? Scope of impact seems to be massive. @MalwareJake @UK_Daniel_Card @SwiftOnSecurity
269K
Mike Manrod
@CroodSolutions
Jul 19, 2024
Replying to @SamunoskeX @MalwareJake and 2 others
So, does anyone else find it odd that the file that caused everything CrowdStrike to freak out, C-00000291-00000000-00000032.sys was 42KB of blank/null values, while the replacement file C-00000291-00000000-00000.033.sys was 35KB and looked like a normal, if not obfuscated
159K
Mike Manrod
@CroodSolutions
Jul 19, 2024
Replying to @CroodSolutions @SamunoskeX and 3 others
That is not really what I was expecting to see, not that it means anything. If the file was empty, I would expected it to be actually empty. If it was an error, I expected a diff to yield a few values that were odd, freaking the system out. What is up with a file full of null
134K
Mike Manrod
@CroodSolutions
Jul 27, 2025
EDR-on-EDR Violence 1/🧵 @BushidoToken called out that EDR products were being abused by threat actors. @Shammahwoods & I realized a free trial of an attacker controlled EDR can be used to kill the existing EDR. @techspence @UK_Daniel_Card @Jhaddix
AutoRMM/- EDR-on-EDR Violence/README.md at main · CroodSolutions/AutoRMM
From github.com
59K
Mike Manrod
@CroodSolutions
Jul 19, 2024
Replying to @CroodSolutions @SamunoskeX and 3 others
Oh, and if someone has better analysis methods that show something other than null values, please share so I can learn and improve (maybe I am missing something obvious).
128K
Mike Manrod
@CroodSolutions
Jul 19, 2024
Replying to @robertgraham @christian_tail and 4 others
That is a good question… I am sure the executable is signed, but not sure about the .sys files / drivers that make it work.
73K
Mike Manrod
@CroodSolutions
Nov 1, 2024
Replying to @AccidentalCISO
Client Engineer: please add the new status code “done-ish” to the ticketing system.
4.9K
Mike Manrod
@CroodSolutions
Aug 3, 2025
For years I have heard that MacOS is more secure than Win. Until recently I have done little to test such assumptions, but have learned some things working to test AutoRMM / Beaconator vectors on MacBook this week. Here are my preliminary observations:
AutoRMM/- Weaponized Documents and Delivery Methods/Macbook Options/README.md at main · CroodSolu...
From github.com
6.9K
Mike Manrod
@CroodSolutions
Jul 19, 2024
Replying to @grittygrease @christian_tail and 4 others
So I suspect there was a 31.sys that probably looked at lot like 33.sys. It was just 32.sys that got mixed up, whatever the cause may have been.
52K
Mike Manrod
@CroodSolutions
Aug 15, 2025
A couple weeks ago, inspired by @BushidoToken's post about EDR abuse, @Shammahwoods and I did some work to explore a little, and found some things. Most notably, that you can use a free trial of one EDR to kill another EDR (also EDR can be an RMM/RAT). 1/🧵
10K
Mike Manrod
@CroodSolutions
Jul 19, 2024
Replying to @anomalyuk @SamunoskeX and 3 others
That is my guess also. I am not inclined to believe they did not test, my guess is that this file somehow got mixed in after successful testing / right before deployment.
14K
Mike Manrod
@CroodSolutions
Jul 19, 2024
Replying to @troyhunt
Same here - extremely widespread. Airports are down.
826K
Mike Manrod
@CroodSolutions
Aug 8, 2025
What is Beaconator C2? w/ @Shammahwoods introducing a C2 framework and set of adversarial emulation tools at @defcon demo labs to provide a robust management console with a wide range of beacon payloads, including payload options for win/MacOS/Linux. github.com/CroodSolutions…
Mike Manrod
@CroodSolutions
Aug 8, 2025
Super excited to present at @defcon #demolabs today at 3pm with @Shammahwoods to release #Beaconator, our new C2 framework. Come check it out, say hi, and find us for stickers!! forum.defcon.org/node/253447
11K