SCYTHE (@scythe

SCYTHE

5,922 posts

SCYTHE

@scythe_io

The most advanced attack emulation platform on the market. Know where you stand with the real thing. 🦄

Columbia, MD

Joined October 2017

Pinned
SCYTHE
@scythe_io
May 5
June's lineup is stacked with data exfiltration tradecraft, macOS backdoor techniques, and AI-augmented social engineering, all grounded in what these shifts mean for detection and response. June 11 | 12:00 - 12:20 PM ET | Threat Thursday LIVE: Protected Data Exfiltration with
382
SCYTHE
@scythe_io
19h
Critical KEVs still open at Day 7 went from 56% to 63% over four years. The patch race is getting worse, not better. Source here: hubs.ly/Q04ks13h0 Your board metric should measure time the exposure existed, not how fast you responded after the fact. Questions? Talk to
32
SCYTHE
@scythe_io
20h
Threat Thursday LIVE: Protected Data Exfiltration x.com/i/broadcasts/1…
108
SCYTHE
@scythe_io
22h
Join us here: hubs.ly/Q04ks8Zr0 Getting data out is the objective that matters most to adversaries and triggers the fewest alerts. Today at 12 PM ET, Trey Bilbrey (@TCraf7) and Tyler Casey walk through exfil across LOLBAS, C2, file hosting, and cloud storage, plus where
112
SCYTHE
@scythe_io
Jun 10
Why bring your own tools when the environment hands them to you? Join Trey Bilbrey (@TCraf7) and Tyler Casey for a 3-hour hands-on LOLBAS workshop, June 24th at 1:00 pm. Full ATT&CK chain, no malware dropped. Register here: hubs.ly/Q04kZ8jV0 #CybersecurityEvents #LOLBAS
36
SCYTHE
@scythe_io
Jun 10
Your EDR sees the process, but does it see where the data went? Tomorrow at 12:00 PM ET on Threat Thursday Live, Trey Bilbrey (@TCraf7) and Tyler Casey walk through protected data exfiltration across LOLBAS abuse, C2 channels, public file hosting, and cloud storage like AWS, plus
522
SCYTHE
@scythe_io
Jun 9
What happens when phishing emails no longer have a single tell your team can catch? AI-generated lures are removing the artifacts detection rules and user training were built around: the typos, the awkward phrasing, the mismatched domains. When the tell disappears, so does the
157
SCYTHE
@scythe_io
Jun 8
An untested SIEM rule is a hypothesis, not a control. SCYTHE runs the technique so you know what fires and what doesn't. See more here: hubs.ly/Q04ksc5b0 #SIEM
100
SCYTHE
@scythe_io
Jun 8
Adversaries read the same detection blog posts you do. You built rules for certutil and bitsadmin, they moved to curl.exe and tar.exe: same download capability, different Microsoft-signed binary, and default baselines still treat both as benign. Check your coverage here:
95
SCYTHE
@scythe_io
Jun 6
An AI agent was told not to delete emails. Its context window got compressed, the rule got dropped, and it started mass-deleting. Who's testing what happens when AI guardrails fail in your environment? Tim Schulz (@teschulz) of @StarseerAI breaks it down. Catch the next Threat
00:00
327
SCYTHE
@scythe_io
Jun 5
Unicorn Dispatch LIVE: Train Like You Fight: The Wartime Mindset for Modern Defenders
REPLAY
SCYTHE
@scythe_io
Unicorn Dispatch LIVE: Train Like You Fight: The Wartime Mindset for Modern Defenders
1.5K
SCYTHE
@scythe_io
Jun 5
Watch live: hubs.ly/Q04jwSdD0 You can't out-defend an adversary you've never faced. Today at 1:30 PM ET, @brysonbort and @snehalantani (former CTO of JSOC, CEO of @Horizon3ai) get into what that means in practice on Unicorn Dispatch Live. #UnicornDispatchLive
180
SCYTHE
@scythe_io
Jun 4
The choreography gets the headlines. The entry point is password spraying. Rob Joyce (@RGB_Lights), Owner at Joyce Cyber and former Cybersecurity Director at the NSA and Trey Bilbrey (@TCraf7) on Iran's hack-and-leak playbook. The mundane stuff is what gets them in. See more of
00:00
286