Ján Trenčanský

https://infosec.exchange/@j91321

EDR R&D team lead and cat herder at ESET.

Blog: https://death.sk
Github: https://github.com/j91321
Bluesky: https://bsky.app/profile/j91321.bsky.social

Public Key

npub1gxkjme408tsepmkjnyeks2dlj9z265xppnzyazup0tuvne9ss5pselhla3

NIP-05 Address

j91321_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsyrtfdu6hn4cvsamffjvmg9xlez39d2rqse3zw3wqh47xfujcg2qcppamhxue69uhkummnw3ezumn0wuqs6amnwvaz7tmwdaejumr0dsrm06zf

Publishing to

nostr.now

nos.lol

relay.damus.io

Author Public Key

npub1gxkjme408tsepmkjnyeks2dlj9z265xppnzyazup0tuvne9ss5pselhla3

Show more details

Last Notes

2026-10-13 17:32:09 UTC

First time I'm dealing with an incident where, at least in my opinion, the operator decided "AI take the wheel" and hand over post-exploitation to LLM. It would be funny, if there wasn't a real damage done. Nevertheless, few observations:<li>LLM clearly has problem distinguishing operator's machine and the beachhead host. So, it leaked his working directory, with username and language when generating a script to copy files between hosts...</li><li>Operator is pretending it is a pentest. So LLM documents everything. There are a lot of debug messages in logs. It checks <code>whoami</code> and <code>hostname</code> way too often.</li><li>Post-exploitations scripts are very helpfully prefixed with a sequential number showing order of execution, making establishing timeline much easier.</li><li>Everything is PowerShell except that one time, when it decided to rewrite <code>tasklist</code> in C#... PowerShell constrained mode would have greatly helped, at least forcing it to be even more noisy.</li><li>It's not fast. I mean the execution is fast, but while the operator reviews output and writes new prompt it takes time, the whole intrusion still spans days and is super noisy.</li><li>Everything is living-off-the-land and generic scripting. No malware.</li><li>It has very uncanny feeling, just like everything AI. Looking at the logs and trying to follow some reasoning is difficult. Weird decisions that don't make sense.</li>