Opalsec

Find me at Intel for Operators, looking at the week's developments in cyber tooling, tradecraft, and incidents:

[Opalsec @0palsec]

#OneNote has become a fixture of recent malware delivery campaigns, with Initial Access Broker kingpins such as #Qakbot, #IcedID, and more getting in on the action.

Get up to speed: Who's abusing it and how to mitigate them - it's all here: https://t.co/bWY0GjXAQJ

#malware #soc

[John Hultquist @JohnHultquist]

Kevin Mandia was reversing Turla malware when I was in high school. Lots of us cut our teeth on them in the early 2000s. These guys operate low and slow and they always seem to be in the background grinding away.

[Matthew @embee_research]

🚨Malware Tips 🚨 - Resolving API Hashes Using Conditional Breakpoints.

By adding breakpoints and log conditions to a function that resolves api hashes, it's possible to quickly resolve api hashes in bulk.

Thread
[1/11] 👇

#Malware #AgentTesla #Ghidra #Debugging

[Opalsec @0palsec]

There's lots to dig through before starting your work week, so get started here:

https://t.co/WkuA34p4jL

[Opalsec @0palsec]

Death by a thousand PaperCuts, China's APT41 uses new tricks to skirt EDR, and a pair of no-patch vulnerabilities take the front page in this weeks newsletter:

https://t.co/WkuA34p4jL

#cyber #infosec #news #newsletter #hacking #malware #vulnerability

[Opalsec @0palsec]

@elasticseclabs have also outdone themselves last week, releasing a suite of tools to decrypt, decompress, recompile, extract and/or parse various #malware payloads distributed in recent #IcedID campaigns.

[Opalsec @0palsec]

Have a great week ahead folks, I hope this newsletter proves helpful!

https://t.co/JXvfay5TFn

[Opalsec @0palsec]

Another week, another newsletter - catch up on the week's infosec news here:

https://t.co/JXvfay5TFn

#cyber #infosec #news #dfir #soc #redteam #blueteam #vulnerability #exploit #ransomware #malware

[Opalsec @0palsec]

The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring #LOLDrivers.

[Opalsec @0palsec]

@Kostastsale @ateixei Amazing work guys, thanks so much for sharing this with the community 🙏🏻

Have you thought about using Mitre Data Sources as the framework to map telemetry coverage, especially if integration with D3FEND and ATT&CK is on the cards?

https://t.co/GEExIsnuwU

[Jeremy Kirk @Jeremy_Kirk]

A deep dive investigation into ransomware and other cybercrime affecting Australia by @4corners. W/ @kmansted, @Jon__DiMaggio, @ClareONeilMP, yours truly and more. Diligent work from @Jess_Longbottom, @TheLyonsDen + @jeanavivem. #infosec #auspol https://t.co/HuQIu2nLoG

[Opalsec @0palsec]

The #blueteam have a script to help tweak VM settings to circumvent malware anti-analysis checks; Procmon for macOS, and a lightweight bastion host to help redirect and record traffic sent to #honeypots in your network.

Get amongst it!

https://t.co/c09RZB9sDB

[Opalsec @0palsec]

It's been a heck of a week, with tonnes of great research and tooling that I'm sure you're going to get a kick out of - check out our wrap-up for all the news!

https://t.co/c09RZB9sDB

#infosec #cyber #news #newsletter #cybersecurity #malware #ransomware #redteam #blueteam

[Opalsec @0palsec]

The #redteam have a new port of the SharpHound AD enumeration tool for #CobaltStrike; a great reference piece on leveraging stolen Office tokens to bypass #MFA and access cloud workloads, and a list of keywords to avoid when crafting stealthy #PowerShell scripts.