Eric Capuano

Eric Capuano

@eric.zip

- Dad of two <3 - Co-founder Recon InfoSec - SANS DFIR Instructor - BlackHat Trainer - IANS Faculty - Trainer @digitaldefenseinstitute.com - Blog: https://blog.ecapuano.com - ⬡ ODESZA, Lane 8, Kasbo 🎧 - ❤ @whit.zip

5.1K followers674 following1.9K posts

Eric Capuano
@eric.zip

CrowdStrike has done some fascinating and impressive work training custom models for threat detection. It does make you wonder, though...whose data did they train on?

Eric Capuano
@eric.zip

I just learned that my dear wife, @whit.zip, owned *three* of these 90s relics on 💿 I thought we all just used the informercials to signal when we've stayed up too late and its time for bed 😂

Eric Capuano reposted

Jake Williams
@malwarejake.bsky.social

Even if you're not a ConnectWise customer, you likely have third party risk management concerns here for those you do business with who are. In most cases, ConnectWise won't be able to see into the customer environments to identify who was compromised - those logs live in the customer tenant.

breachplease-fm.bsky.social@breachplease-fm.bsky.social

ConnectWise's OAuth breach hit 162 M365 tenants and killed its own SkyKick backups. @malwarejake.bsky.social and @secitup.bsky.social break down the attack chain and third-party risk fallout on today's Breach Please. #infosec Watch: youtu.be/AxsG32Derp8

Eric Capuano
@eric.zip

Dropped my $5000 MacBook Pro M5 Max, fully open, face down on an aluminum stand. Keyboard and mouse stopped working, fans pegged to 100% for no reason. Got into Apple Store next day, $0 repair because AppleCare and “no visible damage”. One of many reasons I only buy Apple these days.

Eric Capuano
@eric.zip

Me: “but I definitely dropped it, I promise” Tech: “but I can’t see physical damage so no deductible, it’s free” Me: “Kthx no further questions”

Eric Capuano reposted

DDI Training
@digitaldefenseinstitute.com

#DFIR folks: a signed launcher can hide an unsigned target. In our Autorunsc 14.3 tests, a change in launcher target resolution buried a real persistence entry. Check your workflows! This is a potential regression from Autorunsc 14.2 and prior. digitaldefenseinstitute.com/blog/autorun...

digitaldefenseinstitute.comAutoruns 14.3: When Signed Launchers Hide Unsigned TargetsA persistence lab led to a closer look at what Autorunsc is actually inspecting—and what its filters can remove.

Eric Capuano reposted

Hayden
@nynir.bsky.social

A new @bhinfosecurity.bsky.social blog from one of the ActiveSOC's senior operators with some in-depth analysis of a malicious browser extension that is still live: activesoc.blackhillsinfosec.com/blog/a-trans...

activesoc.blackhillsinfosec.comA Translator Extension, a Lapsed Domain, and 87,000 InstallsA translator extension changed hands after its domain lapsed, then spent ninety-nine days reporting every page a finance user visited. Every endpoint control on the workstation stayed clean the whole ...

Eric Capuano reposted

Whitney Champion 🍪
@whit.zip

we were supposed to go to the ocean's calling festival this weekend in maryland, but the weather had other plans festival got cancelled, hotel got cancelled, so @eric.zip and i made our own adventure 🔥

Eric Capuano
@eric.zip

Maybe AI can fix Teams on its way to world domination.

Tom Warren@tomwarren.co.uk

Microsoft is announcing its new Copilot "super app" today, and it thinks it will be as influential as Office was during the PC era. The new Copilot merges AI chat, coding, and Autopilot agents. Full details 👇 www.theverge.com/news/1000532...

theverge.comMicrosoft thinks its new Copilot ‘super app’ will be as influential as OfficeThe new Copilot merges AI chat, coding, and Autopilot agents.
Eric Capuano
@eric.zip

Dropped some research and detection/hunt content on CVE-2026-85706 🤓

Black Hills Information Security@bhinfosecurity.bsky.social

Hunting CVE-2026-85706 in GitLab logs? A 400 saying "branch is required" is not a failed attempt. It means the file was read. We proved it by planting files with known contents and watching the error change. https://activesoc.blackhillsinfosec.com/blog/the-gitlab-exploit-with-no-traversal-in-it/

Eric Capuano
@eric.zip

After nine years, I’ve left SANS. I’m deeply grateful for the students, colleagues, and experiences that shaped this chapter of my life. For those interested, I wrote about why I left and the principle behind that decision. www.linkedin.com/pulse/after-...

linkedin.comAfter nine years, I’ve left SANS.That sentence is harder to write than the decision itself. Over 9 years, I taught FOR508, helped author the foundation of FOR608 in its early days, and later taught it.
Eric Capuano
@eric.zip

Kids: “dad, can we go to the mall?” Me: “sure but we’re not spending a bunch of money” Meanwhile, me after the mall:

Eric Capuano reposted

DDI Training
@digitaldefenseinstitute.com

Huge thanks to all of our ASOTH students for choosing us this year at Black Hat! We had an absolute blast with you all, and hope to see you again! Another Hacker Summer Camp in the books! 🤓🔥💙

Eric Capuano reposted

Johan Berggren
@jbn.the4711.net

I'm releasing a new tool for all #tailscale users. `tss` is a fast, interactive tool to search, pick, and connect to your Tailscale nodes from the terminal. It works as an interactive TUI picker or a one-shot CLI that fuzzy-matches hostnames and connects you directly. github.com/berggren/tss/

github.comGitHub - berggren/tss: Tailscale Host SelectorTailscale Host Selector. Contribute to berggren/tss development by creating an account on GitHub.
Eric Capuano
@eric.zip

From a detection standpoint REALITY is the interesting bit — it defeats naive TLS-cert and SNI-based egress detection because the handshake is borrowed from a legitimate site (e.g. www.microsoft[.]com).

Eric Capuano
@eric.zip

Detection leans on flow behavior, destination ASN vs. SNI mismatch, and long-lived sessions rather than cert artifacts. It shows up in the wild both as censorship circumvention and as an adversary C2/tunneling layer.

Eric Capuano
@eric.zip

Protocols it speaks: VLESS, VMess, Trojan, Shadowsocks, SOCKS, HTTP, WireGuard, Hysteria2 (newer builds) Transports: TCP, mKCP, WebSocket, HTTP/2, gRPC, QUIC, HTTPUpgrade

Eric Capuano
@eric.zip

I think I figured out how Spectrum earned it's name.... Their internet service operates on a "spectrum" between "up (sort of)" and "can't even ping 1.1.1.1"

Eric Capuano
@eric.zip

LFG 🚀

DDI Training@digitaldefenseinstitute.com

Sneak preview of what we're cooking up for this weekend 👀🔥 This is our 8th year teaching at @blackhatevents.bsky.social, and our Advanced Security Operations & Threat Hunting course is more fun than ever! 🤓 There are still a few seats left if you want to join us! blackhat.com/us-26/traini...