petergs

Hugging Face July 2026 Incident MITRE ATT&CK Mapping

The activity taken by the ~1200 agents operated by OpenAI largely maps to techniques in the MITRE ATT&CK framework. This gist provides a brief mapping as observed by responders at Hugging Face and as reported by OpenAI.

Report Quote	Tactic	Technique
Agents exploited a token-refresh vulnerability to obtain administrator-level Artifactory access	Privilege Escalation	[T1068 Exploitation for Privilege Escalati

petergs

Troubleshooting CrowdStrike Network Containment

These commands assume MacOS, but can be adapted to other operating systems.

Issue 1 - Containment Status Not Reflected in Console

I've observed devices that do not indicate that they're network contained in the console, but when using falconctl indicate that they are (contained=1). You can check this with

$> sudo /Applications/Falcon.app/Contents/Resources/falconctl stats | grep 'contained:'
contained: 1

petergs

Connecting pyodbc to SQL Server with a Domain Account on macOS using FreeTDS

1. Install dependencies

Assumes Homebrew is already installed.

brew install unixodbc freetds

2. Register the FreeTDS driver

petergs

Claude Code Forensics Artifacts

A few notes on investigating execution of malicious skills via Claude Code

Plugins, Marketplaces, & Skills

MacOS/Linux

# installed plugins 
$> cat ~/.claude/plugins/installed_plugins.json
{
  "version": 2,

petergs

terraform plan -out=tfplan
terraform show tfplan | less -R

petergs

# 1. install iamlive 
brew install iann0036/iamlive/iamlive

# 2. run iamlive 
iamlive --mode proxy --output-file readonly.json --force-wildcard-resource 

# 3. in a separate terraform window
export HTTP_PROXY=http://127.0.0.1:10080
export HTTPS_PROXY=http://127.0.0.1:10080
export AWS_CA_BUNDLE=~/.iamlive/ca.pem

petergs

<#
    File: Invoke-EnumerateAzureBlobs.ps1
    Author: Karl Fosaaen (@kfosaaen), NetSPI - 2018
    Description: PowerShell function for enumerating public Azure Blob file resources.
    Parts of the Permutations.txt file borrowed from - https://github.com/brianwarehime/inSp3ctor

    Small updates by @petergs captured in these PRs:
    - https://github.com/NetSPI/MicroBurst/pull/53
    - https://github.com/NetSPI/MicroBurst/pull/54
#>

petergs

Bookmarks

MacOS

MacOS DFIR

Apple Unified Log

• https://www.kandji.io/blog/mac-logging-and-the-log-command-a-guide-for-apple-admins
• https://www.crowdstrike.com/en-us/blog/how-to-leverage-apple-unified-log-for-incident-response/
• https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/Predicates/AdditionalChapters/Introduction.html

Microsoft

Azure / Entra / M365

petergs

import requests
import json
import pathlib
import sys

def upload(access_token: str, file_path: str, file_name: str):
    headers = {
        'Authorization': f'Bearer {access_token}',
        'Content-Type': 'text/plain'
    }

petergs

Microsoft Graph CLI Cheatsheet

I've generally found the Microsoft Graph CLI (mgc) hard to work with. In many cases, harder than using the Graph API endpoints directly or language-specific SDKs. In general, Entra directory-related commands seem to work well, but other parts of the Graph API are rough around the edges from a usability perspective.

This doc provides some quick examples so I never have to work through the trial-and-error of figuring them out again.

OneDrive

Listing and downloading items