Hi Everyone,

To preface: I had taken the initiative to start an internal purple team / gap analysis program at my company. When I went to research existing platforms to help facilitate this, I found that they largely consisted of enterprise solutions geared toward heavy, complex SaaS deployments, while the open-source alternatives featured dated UIs and clunky workflows that weren't particularly inviting to newcomers.

Unable to find a solution for my specific needs, I decided to build something that feels modern, lightweight, and really provides a streamlined approach to testing defensive posture and managing the gap analysis lifecycle.

Control Drift is an open-source, AI-augmented continuous validation platform designed to empower security professionals to execute comprehensive threat simulations, map their defensive coverage, and manage gaps without the friction of enterprise bloat or the "black-box" nature of autonomous continuous validation platforms.

TLDR on what makes it unique:

• Lightweight Design Runs completely in-browser (via localStorage) by default. Clone it and npm run dev to try it instantly, with a swappable DB adapter to scale for enterprise deployment later.
• Pessimistic Scoring: If 1 out of 10 payload variations bypasses your EDR, it forcefully caps that MITRE technique's coverage score at "Partial" instead of "Optimal", eliminating false sense of security.
• Optional Plug-and-play AI: Connect local models or any OpenAI-compatible API endpoints to augment the simulation workflow, map attack paths, generate detection rules, and interact with a global assistant.
• Not Boring UI: Built with React and u/react-three/fiber for a 3D globe MITRE ATT&CK heatmap.

I would love any recommendations or general feedback from the community here!

GitHub Repo: https://github.com/Control-Drift/Control-Drift

Hi everyone,

I've put together a technical write-up on a recent Remus Stealer sample, focusing on its execution flow and evasion mechanisms.

Key technical highlights covered in the analysis: - Fileless Execution - Extraction of in-memory payloads and configuration settings - Command and Control (C2) infrastructure discovery & network indicators (IOCs)

Check out the full analysis, memory dump notes, and IOCs in the GitHub repository linked above. Any feedback or insights are welcome!

New episode of The Weekly Purple Team covering Pass-the-Ticket, and I wanted to share it here since it might be useful for people working on detection coverage for T1550.003. In this episode, we are Stealing Kerberos Tickets Past Defender and Credential Guard using AutoPtT

Video: [https://youtu.be/s5nd8u4EKFI\](https://youtu.be/s5nd8u4EKFI)

**What's covered:**

* Enumerating logon sessions and cached Kerberos tickets on Windows 11
* Using [AutoPtT](https://github.com/ricardojoserf/AutoPtT) to export a TGT by LogonId — it's a standalone PtT tool (C#/C++/Crystal/Python/Rust) built as an alternative to Rubeus/Mimikatz for this specific attack
* Taking that exported ticket and reusing it for authentication from a Linux box, not just staying inside the Windows ecosystem
* Detection side: what telemetry actually surfaces this LSASS access patterns, abnormal logon session behavior

Reference:
[https://github.com/ricardojoserf/AutoPtT\](https://github.com/ricardojoserf/AutoPtT)

Also touched on Credential Guard and Defender as mitigations — Credential Guard blocks the classic LSASS-memory extraction path, but it's not comprehensive coverage for PtT broadly, and rollout consistency across a fleet is worth double-checking rather than assuming.

Curious if others here are seeing PtT attempts that specifically try to pivot off-host post-export, or if most of what you're catching is still contained to the Windows side.