<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>War Room</title>
	<atom:link href="https://warroom.rsmus.com/author/bmcgavin/feed/" rel="self" type="application/rss+xml" />
	<link>https://warroom.rsmus.com</link>
	<description>Shells From Above</description>
	<lastBuildDate>Wed, 11 Mar 2026 21:06:39 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://warroom.rsmus.com/wp-content/uploads/2018/09/cropped-favicon-32x32.png</url>
	<title>War Room</title>
	<link>https://warroom.rsmus.com</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Threat Hunt Report: CORNFLAKE.V3 Backdoor with Remote Code Execution Capability</title>
		<link>https://warroom.rsmus.com/threat-hunt-report-cornflake-v3-backdoor-with-remote-code-execution-capability/</link>
		
		<dc:creator><![CDATA[Ben McGavin]]></dc:creator>
		<pubDate>Tue, 02 Sep 2025 14:20:28 +0000</pubDate>
				<category><![CDATA[Uncategorized]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6287</guid>

					<description><![CDATA[Executive Summary This document presents the results of a targeted threat hunt conducted in search of tactics, techniques, and procedures (TTPs) associated with the CORNFLAKE.V3 backdoor. During the investigation, a backdoor with remote code execution capabilities was discovered; however, its direct connection to CORNFLAKE.V3 remains unconfirmed. The report details the hunting process, describes how the [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Threat Hunting Win: Uncovering Multi-Stage Malware from RMM Abuse</title>
		<link>https://warroom.rsmus.com/threat-hunting-win-uncovering-multi-stage-malware-from-rmm-abuse/</link>
		
		<dc:creator><![CDATA[Ben McGavin]]></dc:creator>
		<pubDate>Thu, 05 Jun 2025 12:57:05 +0000</pubDate>
				<category><![CDATA[Defense]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6280</guid>

					<description><![CDATA[At RSM Defense, we embrace a proactive approach to cybersecurity. Instead of waiting for alerts to trigger a response, our Threat Hunting team regularly conducts hypothesis-driven investigations. These investigations are designed to uncover subtle threats hiding within behavior that might seem legitimate. In late May 2025, our proactive approach paid off when we uncovered an [&#8230;]]]></description>
		
		
		
			</item>
	</channel>
</rss>
