Dwyer (@_dwyer_) 's Twitter Profile
Dwyer

@_dwyer_

Threat research is the name of my game. I know enough to know that I have a lot to learn. opinions are my own

ID: 816642748824637440

calendar_today04-01-2017 13:49:38

930 Tweet

2,2K Followers

362 Following

Dwyer (@_dwyer_) 's Twitter Profile Photo

I'm not kidding, I really think that learning how to work with and manipulate CSV/JSON/XML data in Python and PowerShell is the most useful skill I've acquired in my career. 10/10 would recco.

Dwyer (@_dwyer_) 's Twitter Profile Photo

Another JS based Microsoft 365 credential harvesting campaign. Wanna learn how to analyze these yourself? Click the link binarydefense.com/resources/blog…

Dwyer (@_dwyer_) 's Twitter Profile Photo

This is becoming a thing. So much so that we're hosting a webinar to talk about what we're seeing in terms of EDR killers, bypasses, and silencers. binarydefense.com/resources/webi…

Dwyer (@_dwyer_) 's Twitter Profile Photo

I spent the last few days getting trashed by my coworkers for watching hoof trimming and car detailing videos to relax. I cannot be the only one!

Dwyer (@_dwyer_) 's Twitter Profile Photo

Installing prereqs or setting up simulation platforms for detection engineering can be a pain when you just want some test data. Might as well make sure my C# skills don't disappear completely.

Installing prereqs or setting up simulation platforms for detection engineering can be a pain when you just want some test data. Might as well make sure my C# skills don't disappear completely.
Binary Defense (@binary_defense) 's Twitter Profile Photo

CryptoJS is showing up in phishing kits more and more.​ But here's the good news, you don't have to be a reverse engineer to break them down.​ Dwyer, Deputy CTO and head of ARC Labs, walks you through how to analyze these attacks like a pro. Because the more you understand

Dwyer (@_dwyer_) 's Twitter Profile Photo

Dudes... please enable Detailed File Share auditing in your environment. All these attackers who switched over to the Impacket suite still run the default configs and it takes like 2 seconds to find them.

Dudes... please enable Detailed File Share auditing in your environment. All these attackers who switched over to the Impacket suite still run the default configs and it takes like 2 seconds to find them.
Dwyer (@_dwyer_) 's Twitter Profile Photo

Yooo you heading to BSidesPGH ?!? Come find me and the Binary Defense team and let's catch up on all things threats, detections, and infosec community! PS - hit up table 20 for a chance to win a prize!

Dwyer (@_dwyer_) 's Twitter Profile Photo

RE: CVE-2025-47812 - Pretty please can everyone proactively put in detections looking for their web enabled processes spawning command interpreters. IR friends, I put together this repo of artifacts and log files a couple years ago that may help: github.com/TactiKoolSec/M…

Dwyer (@_dwyer_) 's Twitter Profile Photo

would you look at that...yet another zero day that can be detected by looking for the web enabled process spawning command interpreters.

Dwyer (@_dwyer_) 's Twitter Profile Photo

I had a great time replicating this exploit and even tho it’s being used for bad stuff you gotta appreciate the elegance of vuln chaining. However, we can’t ignore that while the vulns change the outcomes remain the same. binarydefense.com/resources/blog…