Andrew (@4ndr3w6s) 's Twitter Profile
Andrew

@4ndr3w6s

Senior Manager of Detection Engineering @HuntressLabs | Prev. Practice Lead, TAC (Purple Team) @TrustedSec | @SpursOfficial Super Fan - COYS!

ID: 857263281349767169

calendar_today26-04-2017 16:01:08

1,1K Tweet

2,2K Followers

2,2K Following

Andrew (@4ndr3w6s) 's Twitter Profile Photo

🕵️‍♂️ Bridging criminal justice and detection engineering… I’m excited to share my latest blog with Huntress, where I merge my academic background in criminal justice with my passion for detection engineering. By applying criminological theories, we gain deeper insights into

Andrew (@4ndr3w6s) 's Twitter Profile Photo

Looks like John Hammond got turned into a Chess.com bot 🤖!! They might have nerfed his Elo, and even gave him an Magnus Carlsen obsession. 🤣 But at least the wit, jokes and sarcasm made the cut!

Looks like <a href="/_JohnHammond/">John Hammond</a> got turned into a <a href="/chesscom/">Chess.com</a> bot 🤖!!

They might have nerfed his Elo, and even gave him an <a href="/MagnusCarlsen/">Magnus Carlsen</a> obsession. 🤣

But at least the wit, jokes and sarcasm made the cut!
Justin Elze (@hackinglz) 's Twitter Profile Photo

This shouldn’t be a topic up for debate and also applies to pentesting. You need to know your tools which often requires looking at code and running them in a lab for observable IoCs.

Andrew (@4ndr3w6s) 's Twitter Profile Photo

💯 percent agreed! But… Wild how everyone’s focused on wiping payloads, but no one mentions cleaning up AD—things that got modified, deleted, or added. Like yeah, your tools are gone, but AD’s still wearing the scars.

Andrew (@4ndr3w6s) 's Twitter Profile Photo

Kerberos-KDCProxy Event 400: ‘An HTTP request was received.’ 🎉 After combing through Kerberos logs for ages, I’ve never felt more enlightened! 🤪

Kerberos-KDCProxy Event 400: ‘An HTTP request was received.’ 🎉 

After combing through Kerberos logs for ages, I’ve never felt more enlightened! 🤪
Andrew (@4ndr3w6s) 's Twitter Profile Photo

Late Friday blog drop! Huntress had some fun with #DefendNot by es3n1n 😈 This tool shows that defense evasion isn’t just about avoiding tools—it’s about bending them. Here’s how attackers turn your security products into blind spots. 🛡️ huntress.com/blog/defendnot…

Andrew (@4ndr3w6s) 's Twitter Profile Photo

“This leverages the Microsoft-Windows-DotNETRuntime ETW provider which is often 'patched' - but why would someone patch an provider they don’t think anyone is collecting data from?” 😈

Andrew (@4ndr3w6s) 's Twitter Profile Photo

Happy to finally share a new blog with Charlie Clark on our work revisiting the Kerberos Diamond Ticket. ✅ /opsec for a more genuine flow ✅ /ldap to populate the PAC 🆕 Forge a diamond service ticket using an ST We finally gave it a proper cut 💎 huntress.com/blog/recutting…

Andrew (@4ndr3w6s) 's Twitter Profile Photo

Excited to be co-hosting the first onsite DEATHCon with just_a_lurker in Austin, TX. It’s happening 😈 Don’t miss this 🤘 eventbrite.com/e/deathcon-202…