Nasreddine Bencherchali
@nas_bench
Followers
11K
Following
24K
Media
1K
Statuses
8K
Detection @Splunk & @cisco | previously @nextronsystems | @sigma_hq & @magicswordio maintainer | Eternal Learner
HAL
Joined August 2011
I wanted to understand what information is available in .pdb files, so I made a tool for it 🔎🪲 Welcome DiaSymbolView - a debug symbol hierarchy and properties viewer based on MSDIA: https://t.co/mSWAolfrFt
3
59
187
Yesterday I ran a livestream testing SessionHop - abusing specific COM objects to execute C2 actions in the context of other users. https://t.co/wj11CNGPtM However, no session enumeration. So I built SessionView, tool to identify sessions https://t.co/Fcdq63tuZ3 Video is on YT!
github.com
A portable C# utility for enumerating local and remote windows sessions - lsecqt/SessionView
1
49
173
Starting 2026 with a new blog! I've really been enjoying my Windows on ARM machine - so my post is about interrupts for WoA. This includes x64/ARM differences, virtual interrupts, Hyper-V's synthetic controller, and Secure Kernel interrupts/intercepts https://t.co/HvSbtsCtGu
connormcgarr.github.io
Interrupt discovery and delivery on Windows on ARM
7
69
260
I publish the v1.1 of a little project I do whenever I have some free time ( and it's worth more than gold or PC memory 😆😆😆) https://t.co/pGaXuRlZnL
https://t.co/OzoNe03FSa
github.com
Generate malware traces for detection tests. Contribute to frack113/MalwareTracesGenerator development by creating an account on GitHub.
0
4
6
IDA Reverse Engineering Step-by-Step Into Reverse Engineering: EXE Patreon Unlocked ❤️
9
207
1K
110 ms delay....
North Korean infiltrator caught working in Amazon IT department thanks to lag — 110ms keystroke input raises red flags over true location
1
0
8
We're about to hit ⭐100 stars on Github for https://t.co/cSbJE1n0oc, if you haven't already, go start and playing around with Sigma detection rules. https://t.co/jtVnnXtF2k
github.com
Convert Sigma rules to SIEM queries, directly in your browser. - northsh/detection.studio
4
19
126
It's happening! Meet the Agentic Threat Hunting Framework (ATHF). Tired of copy-pasting the same hunt template over and over? Same. I built a framework designed for an AI-assisted future that adds structure, memory, and context to every hunt. https://t.co/bR1qS0HFvh
0
7
11
The #LOLRMM #Sysmon configuration has the DNS, Named Pipe and Network Connection Sections now done aswell. Feel free to check it out. @M_haggis @nas_bench @Kostastsale @cyb3rbuff @_josehelps @cyb3rops
https://t.co/cNb0ypwXco
github.com
A sysmon configuration designed for monitoring RMM solutions from the LOLRMM framework on the OS Microsoft Windows. 10/11 - shotgunner101/Sysmon-LOLRMM
1
25
97
We found that the fix to address the DoS vulnerability in React Server Components (CVE-2025-55184) was incomplete and does not prevent an attack in a specific case. This is disclosed as CVE-2025-67779. New patches are available now, please update immediately.
0
0
9
Ever wonder why we call them "Cmdlets" in PowerShell instead of just "Commands"? https://t.co/PTxB02yXmY
#PowerShell
jsnover.com
I’ve spent a lot of time, and acquired a lot of scar tissue, in this industry, and if there is one thing I’ve learned, it’s that most people are terrified of looking different. People hug the cente…
4
24
94
What a beautiful performance of "Une vie à t'aimer" from Clair Obscur: Expedition 33! Fun Fact: the game is the most-nominated game in the history of #TheGameAwards. @lornebalfe @expedition33 @sandfallgames @kepler_interact
178
5K
17K
⚡The team killed it on this end of the year release of ESCU 5.19! I'm so grateful to work with such talented and passionate people. @nas_bench, @raven_tait, @bareiss_patrick, @hackpsy, @rodsoto, @tccontre18, Lou Stella Release: https://t.co/smqTLl7Dfx Key highlights: 🐚
0
3
10
Splunk content release, ESCU 5.19 is here, and its one of our biggest releases of the year. 🌟6 New Analytic Stories 🔍31 New Analytics ⚙️71 Updated Analytics Key highlights from this release include - New Coverage for React2Shell, CVE-2025-33073 and Tuoni C2. - New Content to
0
12
35
Errybody screaming about React2Shell so we wanted to give ya something you haven't already heard😁 Here's a beast of a blog post on malware we've seen from post-exploitation, detailing a wild Linux backdoor and more -- all from the amazing & incredible @RussianPanda9xx & co.😎
Super hyped to share that @HuntressLabs published a Rapid Response blog on the recent #React2Shell post-exploitations observed. We discovered and analyzed a few payloads that were named #PeerBlight, #CowTunnel and #ZinFoq. We also observed a variant of #Kaiji malware. 3 Modelo's
9
69
367
This is a work in progress that will get updated as soon as finish a couple more things.
0
0
6
I have spent some time this past day to investigate NodeJS source code and how a typical process tree from a react/next.js app will look like. If you are building detections for React2Shell give this a read. as it'll help you identify the right strings to use to filter down FPs
3
29
128
Final part of the first wave of RPC is live, RPC part8. In this part, I explain how to use IDA to reverse RPC clients and servers, and I show the key structures and methods you need to extract all the important information during the reversing process. https://t.co/lgaE52Uc9P
sud0ru.ghost.io
Welcome to the next part of the IPC series, and the final part of the first wave of RPC series. In this post, we will look at the tools you can use to reverse-engineer an RPC server. This part...
1
24
85
I wanted to follow-up and let @M_haggis @nas_bench @Kostastsale @cyb3rbuff @_josehelps know that the Sysmon config for the LOLRMM framework is "effectively" complete for the primary areas of focus. I have intentions to add more filtering to it but it is. https://t.co/pjGhu9Q9c4
dodgethissecurity.com
I have spent the last month and a half working on a Sysmon configuration for the LOLRMM framework. This framework is extremely useful for those who intend to hunt down RMMs within their environment…
6
25
53
Full length reverse engineering with Invoke RE! Showcasing new iterations of the "Scavenger" malware, or what we saw as "ExoTickler" previously as a fake City Skylines 2 video game mod, now w/ more crypto/creds stealing and C2. Binary Ninja, x64dbg & more: https://t.co/AvW8A6lROO
5
32
200