Payload Podcast 010 - Olaf Hartong

Payload Podcast 010 - Olaf Hartong

by John Hammond

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 John Hammond 👥 2.2M 📅 July 29, 2026 ⏱ 66 min 👁 3K 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

detection engineeringSysmonAI agentsC2OpenAI

Summary

In this episode of the Payload Podcast, John Hammond and co-host interview Olaf Hartong, a prominent detection engineer and co-founder of Falcon Force. Olaf shares his background from network engineering to security, and discusses his work on Sysmon modular configurations, including a new tool suite to validate and update Sysmon configs. He also talks about detection health monitoring, highlighting common issues like broken detections and subtle errors in query logic. The conversation then shifts to AI security, with John presenting his recent research on abusing OpenAI’s Codex remote control feature for command and control, demonstrating a C2 profile that communicates over OpenAI infrastructure. They discuss the lack of logging around AI agents, making detection difficult. Olaf offers his perspective on AI’s growing role in both offensive and defensive security, noting its potential when properly engineered. The episode also touches on upcoming conferences like Black Hat and Defcon.

147 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information is high for practitioners in detection engineering and security research. Olaf provides practical insights into common detection pitfalls, such as casing sensitivity in joins and the importance of data health monitoring. John’s research on using OpenAI’s Codex as a C2 channel is novel and demonstrates a real attack vector. The argumentation is based on hands-on experience and recent research, making it credible. However, the conversational format sometimes lacks depth, and some claims are not fully elaborated.

Scientific Rigor, Source Quality, Title Accuracy

The podcast is a discussion format, so sources are not formally cited. However, the speakers reference their own work and tools, such as Sysmon modular and Falcon Hound. The title accurately reflects the content. The technical depth is appropriate for a professional audience, and the information appears reliable based on the speakers’ expertise. No external sources are provided in the description, but the speakers’ credibility adds to the rigor.

165 words

Title / Content Match

The title accurately reflects the content: a podcast episode featuring Olaf Hartong.

Quality & Reliability

8/10

The podcast features Olaf Hartong, a well-known detection engineer and founder of Falcon Force, discussing practical detection engineering, AI security research, and tooling. The information is based on hands-on experience and recent research, but it is conversational and lacks formal citations.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • Olaf Hartong's GitHub — Mentioned as the source for Sysmon modular and other tools.
  • Falcon Force website — Mentioned as the company Olaf co-founded.
  • John Hammond's blog on OpenAI Codex C2 — Referenced as the blog released on the day of the podcast.

Concurring Sources

  • Sysmon documentation — Provides background on Sysmon, which is central to the discussion.
  • MITRE ATT&CK — Framework used for tagging detections, mentioned in the podcast.

Contribution & Novelties

The podcast provides unique insights into detection engineering practices and a novel attack technique using OpenAI’s Codex for C2. It highlights the lack of logging around AI agents, a growing concern. The discussion offers practical advice for improving detection health and emphasizes the need for better visibility into AI interactions.

Pour aller plus loin :

  • Sysmon — Official documentation for Sysmon, relevant to the discussion.
  • MITRE ATT&CK — Framework referenced for detection tagging.
  • OpenAI Codex — The AI tool discussed in the C2 research.

84 words

Radar Profile

The radar profile shows high scores in information quantity and quality, reflecting the depth of technical content. The technical level is high, indicating the content is aimed at professionals. Reliability is strong due to the speakers' expertise, though the lack of formal citations slightly lowers it.

Reliability 8/10

💬 No comments were provided for analysis.