H?ckers A[r]e Gl*bbing
•February 27, 2026
0
Why It Matters
Wildcard command obfuscation lets attackers evade static detections, forcing security teams to adopt AI‑enhanced analytics and updated rule sets to protect modern, living‑off‑the‑land attack vectors.
Key Takeaways
- •New LOLGlobs catalog documents wildcard command obfuscation across OSes
- •Wildcard techniques can bypass literal-string detection in EDR tools
- •Project integrates with living‑off‑the‑land resources for broader threat intel
- •Demonstrated PowerShell payload delivery using obfuscated IEX and IWR commands
- •ExaForce AI platform highlighted as potential automation for detecting such evasion
Summary
The video introduces LOLGlobs, a community‑driven repository that catalogs wildcard‑based command‑line obfuscation techniques for Linux, macOS, Windows CMD, and PowerShell. Originating from a security‑operations Slack channel and authored by HexV1N at ReliaQuest, the project builds on earlier efforts like Argfuscator and the broader “living‑off‑the‑land” (LOL) ecosystem, providing a searchable API for analysts to explore evasion patterns.
Key insights include the prevalence of command‑obfuscation as a top detection‑evasion tactic, the use of asterisks and question marks to mask critical binaries, and the seamless integration of these tricks with native OS utilities such as where.exe, for‑loops, and PowerShell aliases like IWR and IEX. The presenter demonstrates a full attack chain: hosting a benign payload on Pastebin, shortening the URL, then invoking it via a heavily obfuscated PowerShell command that never reveals the literal Invoke‑WebRequest or Invoke‑RestMethod strings.
Notable examples feature a side‑by‑side comparison with Argfuscator, a deep dive into Windows CMD nuances, and the use of the PolyUploader tool to scatter payloads across obscure file‑hosting services. The speaker also highlights ExaForce’s agentic AI, which combines semantic, behavioral, and knowledge models to parse such complex patterns without the “black‑box” uncertainty of generic LLMs.
The implications are clear: traditional signature‑based detections will miss these wildcard‑driven attacks, prompting SOCs to adopt more context‑aware analytics and AI‑assisted tooling. By centralizing obfuscation techniques, LOLGlobs equips defenders with the intel needed to harden detection rules and automate response, while also underscoring the growing importance of AI platforms like ExaForce in scaling threat‑hunt operations.
Original Description
https://jh.live/exaforce || Keep pace with today's hackers with AI capability on your own turf -- try an agentic AI security operations center with Exaforce: https://jh.live/exaforce
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: https://jh.live/openvpn
Get Blue Team Training and SOC Analyst Certifications with CyberDefenders: https://jh.live/cyberdefense
0
Comments
Want to join the conversation?
Loading comments...