Keith (@kwm) profile picture

Keith

@kwm

Award-winning husband and dad. Co-founder @redcanary. Tweets are my own, unless otherwise noted.

 Denver, CO, US
kwm.me
Joined March 2007
  • Tweets3.1K
  • Following621
  • Followers3.2K
281Media
Photo by Keith (@kwm)Photo by Keith (@kwm)Photo by Keith (@kwm)Photo by Keith (@kwm)Photo by Keith (@kwm)Photo by Keith (@kwm)Photo by Keith (@kwm)Photo by Keith (@kwm)Photo by Keith (@kwm)Photo by Keith (@kwm)
Pinned Tweet
Keith (@kwm) profile picture
Keith@kwm5 Feb 2024
I put together a simple, web-based tool inspired by @sounilyu's Cyber Defense Matrix. Quickly visualize program maturity, controls, roadmap, more. - Customizable asset classes - PNG export - JSON export/import Overview📄 kwm.me/articles/cybersecurit… Tool 🛠️ cybermaturitymatrix.com/
3
7
1
25
4,598
Something we need to start talking about urgently: huge numbers of old software bugs are being found and closed right now. Intelligence and law enforcement agencies depend on these bugs for access. What are they going to do when this access is gone?
91
161
59
1,057
153,598
Keith retweeted
DbgMan ^_^ (@0XDbgMan) profile picture
DbgMan ^_^@0XDbgManAug 1
New blog Spent way too much time reverse engineering CrowdStrike Falcon. Somewhere along the way, I found a bug. It's low and not practically exploitable... but a bug is a bug :) Publishing soon 0xdbgman.github.io/posts/ins…
Inside the Falcon How CrowdStrike Catches You

Inside the Falcon How CrowdStrike Catches You

A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service...

0xdbgman.github.io
17
121
3
490
39,463
Gemini: Try Spark, a new agent-looking thing! Me: *Tries Spark* Me, to Spark: "Help me get started with this new tool. What are some Spark use cases?" Spark: *Researching Apache Spark use cases* . . . "Apache Spark is a <goes on forever>"
3
274
The real lesson with the Hugging Face incident is: “CISOs learn of new risks not already on their radar through data breaches”. And, there are breaches and incidents we should pay attention to right now: GitHub, AWS, and yes - Hugging Face. A thread
1
4
14
1,745
Keith retweeted
VMRay (@vmray) profile picture
VMRay
@vmray22 Apr 2025
Threat Detection Highlights Webinar series – April Edition: This month’s session is extra special. zoom.us/webinar/register/WN_… We're excited to welcome Tony Lambert @ForensicITGuy , Senior Malware Analyst at @redcanary, known for his sharp research and impactful community contributions. Joining him is Patrick Staubmann from @vmray Labs, who will bring his researcher’s lens to the latest detection techniques and platform updates. On the agenda: 🧠 Detecting CPU property queries via registry (new VTI) 🕵️‍♂️ Anti-sandbox YARA rules: Latrodectus, Hijackloader & "Paste & Run" 💥 Ransomware-focused YARA detection 🐀 RAT config extraction + DNS tunneling ⚡ Quick sandbox demo 🎯 Save your seat now — you won’t want to miss this deep dive into the latest threat detection techniques: zoom.us/webinar/register/WN_…
Image from VMRay (@vmray)
5
10
1,167
Sure, your POC or framework will be used by ~10% of blue teams (and to make matters worse, only ~10% of orgs have a blue team with time/energy to even think about it). Meanwhile, it's 100% going to be used for this.
Mattias Wåhlén 🇪🇺🇺🇦🇨🇦 (@WahlenPMattias) profile pictureMattias Wåhlén 🇪🇺🇺🇦🇨🇦@WahlenPMattias17 Feb 2025
Replying to @ImposeCost @BarrettJ
I think that the problem is that many in the hacking community still imagines that they are sticking it to the tech giants like Microsoft when they do it. No, you’re sticking it to a children’s hospital…
1
1
420
Keith retweeted
Wietze (@Wietze) profile picture
Wietze@Wietze6 Feb 2025
🚀 Today I'm launching ArgFuscator: an open-source platform documenting command-line obfuscation tricks AND letting you generate your own 🔥 68 executables supported out of the box - use right away, make tweaks, or create your own 👉 Now available at argfuscator.net
18
181
10
665
61,217
Today at WWHF @Wietze is dropping Invoke-ArgFuscator 👀 github.com/wietze/Invoke-Arg…
GitHub - wietze/Invoke-ArgFuscator: Invoke-ArgFuscator is an open-source, cross-platform PowerShell...

GitHub - wietze/Invoke-ArgFuscator: Invoke-ArgFuscator is an open-source, cross-platform PowerShell...

Invoke-ArgFuscator is an open-source, cross-platform PowerShell module that helps generate obfuscated command-lines for common system-native executables. - wietze/Invoke-ArgFuscator

github.com
1
25
2
85
11,868
Dave Aitel, writing on DailyDave: "This is probably my new favorite podcast, with an uncensored take on current infosec events, largely from an incident response standpoint, but in general covering all the bases and courageously offending everyone at great length." @daveaitel @craiu @juanandres_gs seclists.org/dailydave/2024/…
3
8
1
34
7,797
Quick ear-check with the listeners: What's the ideal length of your favorite podcast?
39%30 mins
41%1 hour
12%2 hours
7%Longer, please
203 votes • Final results
4
6
1
7
4,747
8-K filings for material cybersecurity incidents should require disclosure of cybersecurity controls (software + services) in place when the event occurred. Think of the immense good that would come from analysis of this data over time. Also, the chilling effect on marketing.
1
3
197
Some expected victim disclosure to be jarring, but the SEC rule normalized it overnight. One of the last bastions of caginess, opacity in this industry are the products and services that a company uses. But when material incidents occur, optimize for transparency and learning.
2
148
"2022 zero day was used to raid Fortigate firewall configs. Somebody just released them" - doublepulsar.com/2022-zero-d…
2022 zero day was used to raid Fortigate firewall configs. Somebody just released them.

2022 zero day was used to raid Fortigate firewall configs. Somebody just released them.

Back in 2022, Fortinet warned that somebody had a zero day vulnerability and was using it to exploit Fortigate firewalls…

doublepulsar.com
Keith (@kwm) profile pictureKeith@kwm15 Jan 2025
Cybersecurity stat of the day: The average delta (in years) between CVE assignment and addition to the CISA Known Exploited Vulnerability (KEV) catalog is 2.8 years. 🤯
1
3
305
Cybersecurity stat of the day: The average delta (in years) between CVE assignment and addition to the CISA Known Exploited Vulnerability (KEV) catalog is 2.8 years. 🤯
3
2
10
2,600
Another day, another email warning "attackers may be exploiting FortiGate devices". Folks. Your Fortinet gear might as well exist *primarily* to grease the skids of initial access for bad actors. These devices help more adversaries than they stop. I think we're past "may be" 🤣
1
3
360
this is way more relatable than yet another email that begins with "at <company> we believe in delivering exceptional value" and ends with "starting next month, your price will increase" but it's definitely the same message 🙃
Sam Altman (@sama) profile pictureSam Altman
@sama6 Jan 2025
insane thing: we are currently losing money on openai pro subscriptions! people use it much more than we expected.
284
A script that logs @objective_see OverSight events to a file: github.com/keithmccammon/ove…
Example of log file written by oversight-logger.sh

ALT Example of log file written by oversight-logger.sh

2
9
2,251
99.9% of us shouldn't worry about the NSA, but 100% of us should worry about the combined marketing and advertising ecosystem, a true global surveillance superpower. krebsonsecurity.com/2024/10/…
1
7
304
CVE-2024-23113 🤦
Image from Alex Chapman (@ajxchapman)
26
205
11
2,469
153,145
The EML Analyzer is also available as a free API, so you can hook it up into your favorite phishing response workflows: docs.sublime.security/refere…
Image from Sublime Security (@sublime_sec)
1
1
14
1,217
Load more