Rob Lowery

Cyber Analyst | Malware analysis | Reverse Engineering | Threat Intelligence | InfoSec Researcher | Hacking | Computer Science

[Justin Elze @HackingLZ]

Other day I asked for large repos of detection rules here is the running list of responses.

Elastic - https://t.co/OwVwhHU3nZ
Sigma - https://t.co/LygEgGSBeB
Chronicle - https://t.co/4QqDyzJCWC
Splunk - https://t.co/csHzWFCpLE
Falcon Force -https://t.co/9cOd5elj3U

[mRr3b00t @UK_Daniel_Card]

Locking down Windows 11! Let's go on a mini adventure!
We are going to configure some GPOs for a Windows 11 PC and Low Priviledge user account

[Europol @Europol]

Bye-bye botnets👋 Huge global operation brings down the world's most dangerous malware.

Investigators have taken control of the Emotet botnet, the most resilient malware in the wild.

Get the full story: https://t.co/NMrBqmhMIf

[Samir @SBousseaden]

a good #dfir remainder (CLR Usage Logs) of Lateral Movement via WinRM using .NET script to execute stuff on a target host (opsec wise won't harm to add this to cleanup routine after execution if any)

[Taz Wake @tazwake]

Got to see my favourite type of Incident Ticket today.
User got suspicious email, reported it because when they followed the link it went to a sign in page but "none of their corporate credentials worked"
For added value, service desk closed ticket cos it wasn't a supported site

[Rob Maslen @rbmaslen]

SharpView, if you've run it on a machine have a look in %TEMP%\ba9ea7344a4a5f591d6e5dc32a13494b you might find a nasty surprise.....

[Francesco Soncina @phraaaaaaa]

PEzor v2 — New Output Formats and Cobalt Strike Integration

Cobalt Strike's execute-assembly lets operators run .NET assemblies without touching the disk. But wouldn’t be nice if we could execute arbitrary executables too with the same ease?

https://t.co/BbW5LyM6E8

[Hussein Daher @HusseiN98D]

#BugBountyTip
/etc/passwd WAF restriction? Use these:
/e?c/?asswd
/e*c/*asswd
/??c/?asswd
/??c/?assw?

[Manish Kishan Tanwar @IndiShell1046]

People are sharing lolbin POCs.
here goes from my side :)
Open MSPaint
Navigate to below mentioned functional path:
File -> Open -> "File name" (All Files)

Specify the file HTTP file path URL. wait for error message.
And get the download file path in error message :)

[Paul L. @am0nsec]

I decided to write a new shellcode self-injector (Injector.Win64.HellsGate) in x64 Microsoft Macro Assembler (MASM) to learn the language.

If you are interested you can have a look here: https://t.co/vHAUjan0XX

[brsn @brsn76945860]

'Removing Kernel Callbacks Using Signed Drivers' - I just released a write-up and tool to blind all EDRs on a system. Many thanks to @matterpreter @gentilkiwi @Jackson_T @SpecterOps @FuzzySec for previous excellent work. Writeup at https://t.co/Sij8hfKLiw

[ᴘᴀʀᴛʜɪ @cyber__sloth]

Someone is testing out their tool/script to weaponize #LNK files. This screenshot shows at least 4 different ways you can download code from internet via Shortcut files. #ThreatIntel #ThreatHunting @James_inthe_box @_re_fox @securitydoggo @JAMESWT_MHT @rpsanch
@Arkbird_SOLG

[Kaspersky @kaspersky]

He was ahead of his time.

[Justin Bui @slyd0g]

Built some automation to help with DLL hijack discovery and found hijacks in Microsoft Teams, Slack, and VSCode. I dig into building the automation, the root cause of shared DLL hijacks b/t applications, and an interesting discovery in the NetShare* APIs!
https://t.co/RVA9lWBnzT

[Lee Holmes @Lee_Holmes]

Did you know that PowerShell lets you work with Alternate Data Streams?

Get-Item ~/Downloads/* -Stream *

[Mike Felch (Stay Ready) @ustayready]

Check out a new tool I just released! An asynchronous password spraying tool in C# for Windows environments that takes into consideration fine grained password policies and can be ran over Cobalt Strike's execute-assembly. https://t.co/5xNkmGvcdr

[mandatory.bsky.social @IAmMandatory]

Releasing another side-project: CursedChrome. A Chrome-extension implant that turns victim Chrome browsers into HTTP proxies. Using these proxies you can browse the web authenticated as your victims for all of their websites. Setup takes only 5-10 mins 👍

https://t.co/CskjvN0vLE

[Jake | JCyberSec_ @JCyberSec_]

Me watching #Emotet hashtag on twitter today ...

My money is on the malspam NOT starting today.