the one of thousands
Joined January 2013
- Tweets2K
- Following1.1K
- Followers133
- Likes18.9K
Michl Schmid retweeted
#ESETresearch analyzed more than 80 EDR killers, seen across real-world intrusions, and used ESET telemetry to document how these tools operate, who uses them, and how they evolve beyond simple driver abuse. welivesecurity.com/en/eset-r… 1/6
Michl Schmid retweeted
Norway consistently wins the most medals at the Winter Olympic Games, with a population of just 5.6 million people.
A big part of their success is how they treat youth sports—and it’s the opposite of what we do in the US. Here’s what we can learn from Norway:
1. Scorekeeping:
In the US: Youth sports tend to be hyper competitive even at early ages. Leagues almost always keep score.
In Norway: Scorekeeping isn’t even allowed until age 13.
Removing winners and losers keeps the focus on the process not outcomes. It keeps kids engaged longer because it minimizes pressure (and tears) and maximizes fun, learning, and growth. The goal isn’t to win a third grade championship. It’s to love sport and keep playing.
2. Trophies:
In the US: If you give everyone a trophy, you’re creating snowflakes who will never gain a competitive edge.
In Norway: Whenever trophies are awarded, they are handed out to everyone.
If getting a trophy makes young kids feel good, we should give them trophies. Maybe they’ll come back and play again next year!!
As for the creation of snowflakes with no competitive edge—Norway’s athletes are tough as nails and all they do is win.
3. Prioritizing Fun:
In the US: Far too often, the goal is to win.
In Norway: The national philosophy is “joy of sport.”
Youth sports in the US are driven by adults, ego, and money. Youth sports in Norway are driven by fun.
Only half of kids in the US participate in sports. The number one reason they drop out: because they aren’t having fun anymore. In Norway, 93% of kids participate in youth sports. Fun is the foremost goal.
4. Playing Multiple Sports:
In the US: There’s pressure to specialize early and play your best sport year round.
In Norway: Try as many sports as you can before specializing as late as college.
Norway encourages kids to try all types of sport. This reduces injury and burnout and increases all-around athleticism. It also helps promotes match quality, or finding the sport you are best suited for as your body develops, which is impossible if you commit to a single sport too early.
5. Affordability
In the US: There is increasingly a pay-to-play model with high fees for leagues, equipment, and travel. This excludes many kids from playing.
In Norway: It’s a national priority to keep youth sports affordable and therefore accessible for all.
Kids aren’t priced out, which creates opportunities for everyone to participate (and develop into athletes), regardless of their parents’ income level.
We could learn a lot from Norway:
In the US, 70% of kids drop out of youth sports by age 13. This not only diminishes an elite-athlete pipeline, but it also destroys an opportunity for healthy habits and all the character lessons kids can learn from sport.
In Norway, lifelong participation in sport is the norm. The goal isn’t to have the best 9U team. It’s to develop the best athletes. Those are two very different things. And Norway has the gold medals to prove it.
Michl Schmid retweeted
Damit Berliner wieder Strom haben: Jens Spahn kauft Steckdosen für 5 Milliarden Euro
der-postillon.com/2026/01/sp…
der-postillon.com/2026/01/sp…
Michl Schmid retweeted
Statement from the Premier of Greenland 🇬🇱
6:55pm local time:
“🇬🇱 We have been a close and loyal friend of the United States for generations. We have stood shoulder to shoulder in difficult times. We have taken responsibility for security in the North Atlantic — and not least for North America. That is what true friends do.
Precisely for that reason, the current and repeated rhetoric coming from the United States is entirely unacceptable.
When the President of the United States speaks of “needing Greenland” and links us to Venezuela and military intervention, it is not only wrong. It is disrespectful.
Our country is not an object in great-power rhetoric. We are a people. A country. A democracy. That must be respected — especially by close and loyal friends.
We are part of NATO, and we are fully aware of our country’s strategic location. We also understand that our security depends on good friends and strong alliances. In that context, a respectful and loyal relationship with the United States is very important. That has been the case for decades.
But alliances are built on trust. And trust requires respect.
Threats, pressure, and talk of annexation have no place between friends. That is not how one speaks to a people who have repeatedly demonstrated responsibility, stability, and loyalty.
Enough is enough.
No more pressure.
No more insinuations.
No more fantasies of annexation.
We are open to dialogue. We are open to conversations. But they must take place through the proper channels and in full respect of international law. And the proper channels are not random and disrespectful posts on social media.
Greenland is our home and our territory.
And it will remain so. 🇬🇱”
Michl Schmid retweeted
Someone helpfully shared yet another "free" THOR build on VT. It’s the real scanner, just repackaged with a .NET stealer and a ScreenConnect dropper on top.
We keep an eye on VT uploads of THOR and see this kind of bundle regularly.
If you’re running cracked security tools on production systems, you’re basically installing other people’s remote access for them ...
Michl Schmid retweeted
Stop downloading 4GB ISOs to create Linux VMs.
You don't need an installer, a GUI, or a "Next > Next > Finish" wizard. You just need a directory of files.
Here is how I build custom, hacky, bootable Debian VMs in 60 seconds using debootstrap.
Your distro is just a kernel and a collection of user-space binaries. If you can place those files correctly on a disk, the kernel will work with it.
1. The "Secret" Tool: We usually treat VM images (.qcow2) as black boxes. But qemu-nbd lets you map that virtual disk to a real device node (/dev/nbd0) on your host. This allows you to format and mount a virtual disk exactly like a physical USB stick.
2. The "Install": Once mounted, you don't "install" Linux. You just unpack it. sudo debootstrap stable /mnt/disk This pulls the minimal binary set needed to run Debian and dumps it into the folder. No wizard required.
3. The Boot: I boot it using QEMU by injecting the kernel directly, skipping the bootloader entirely: qemu-system-x86_64 -kernel ... -append "init=/bin/bash ..."
4. The "Panic" (It's actually a success): If you look at the last screenshot, you'll see a "Kernel panic - Attempted to kill init!". This is actually a victory. I told the kernel to run a simple script. The script finished. init exited. The kernel panicked because it had no other tasks to do. Task failed successfully.
This methodology is powerful for CI/CD or rapid prototyping. It proves that if you understand the file structure, you own the system.
Have you ever built a root FS from scratch?
If you want to build a custom little Linux micro distro in 10 minutes, check out this link 🔗 popovicu.com/posts/making-a-…
Michl Schmid retweeted
A very friendly reminder, especially for non-corporate PCs protected with BitLocker: if you are not sure if you have your Recovery Password handy, you can display it any moment with "manage-bde -protectors -get c:"
Store the password in your password manager and make its backup!
Hi @KilobyteTheDust I got a question regarding the contents of your @Antisy_Training course "Security Operations" I think there's a wrong video inside. ☺️
Feel free to DM me.
30
Michl Schmid retweeted
This is why you don't share just everything on the web.
The vid you see here must be one of the most effective AI awareness videos.
Michl Schmid retweeted
Thanks to everyone who attended. It's good to be back in Augusta.
The links I mentioned can be found here: chrissanders.org/links
Next up at Security Onion Conference is @chrissanders88 and @DefensiveDepth presenting Investigation Playbooks for Humans
Super proud passing the @sansforensics @CertifyGIAC #GLIR exam lately!!!
😮💨🐧🎉😉
linkedin.com/posts/michael-s…
1
4
89
Michl Schmid retweeted
Here’s a slide from our upcoming THOR v11 roadmap - a 75% rewrite with major architectural changes and new features.
Beta with customers & partners starts soon, TechPreview in December.
Since THOR Lite is based on the same code, free users will benefit too.
@nextronresearch @nextronsystems #DFIR #DigitalForensics #CompromiseAssessments #YARA #Sigma #IOCs
Michl Schmid retweeted
Your Docker containers are slow, bloated, and vulnerable. And you’re probably making the same mistakes 90% of engineers make in production.
Take my advice and please
• Don’t use “latest” tags, instead use specific versions like node:18.17-alpine
• Don’t build single-stage fat images; instead, use multi-stage builds to get 50MB images instead of 800MB
• Don’t run containers as root, instead, create a non-root user for security
• Don’t copy everything with COPY . ., instead use .dockerignore and specific COPY commands
• Don’t let containers use unlimited resources, instead set proper memory and CPU limits
• Don’t deploy without health checks, instead add HEALTHCHECK commands so Kubernetes knows your app works
• Don’t create 20 separate RUN layers, instead combine commands with && to minimize layers
• Don’t skip security scanning, instead use docker scan or Trivy in your CI/CD pipeline
• Don’t use full OS images for simple apps, instead use scratch or distroless base images
• Don’t write logs to files inside containers; instead, log to stdout/stderr and let orchestrators handle collection
These practices make the difference between hobby projects and production systems.
Your containers should be fast, secure, and predictable. Not slow, vulnerable time bombs.
Michl Schmid retweeted
Good analysts take broad investigative questions and unpack them into specific questions that are directly answerable from evidence.
Let's say that you observed the download of a suspicious file, but it's no longer located on the file system.
You might ask, "Why isn't the downloaded file on the file system?"
That's a start, but it doesn't exactly point you straight towards an evidence source to examine. So, you ask yourself, if the file isn't on the file system, what could have happened to it? That's forecasting... simulating and considering possibilities.
Maybe a dropped file deleted it... "Were any new files created right after the download?"
Maybe AV caught it... "Did AV detect or block the file?"
Maybe its name has changed... "Does the file hash exist anywhere on the system?
Logically, it's okay to start with the broad question, but you can't end there. If you want to level up your investigative skills, focus on unpacking your broad questions.
#DFIR #SOC
Michl Schmid retweeted
The Chinese launch thousands of drones from special containers carried by a “transformer” truck.
Currently used by a civilian drone light show company, the concept extrapolates to rapid launches of massive military drone swarms.
Michl Schmid retweeted
New Blog Post: Sindoor Dropper #Phishing Campaign
A new phishing campaign targeting Indian orgs abuses .desktop files to infect #Linux systems - a technique linked to #APT36 in past ops.
- Linux-first phishing tradecraft
- Stealthy delivery via disguised .desktop file
- Multi-stage obfuscated payload chain
- Final payload: #MeshAgent RAT
- Packed Go binaries with stripped ELF headers
- Google Drive abuse, no AV detections on VT
- Basic anti-VM, sandbox evasion, staged decryption
- Full technical breakdown + IOCs + #YARA
Not your average phishing kit.
by @petri_ph
nextron-systems.com/2025/08/…
