Ali Hussein

Penetration Tester turned into Blue Team and IR Specialist
#PurpleTeaming #DFIR

[Ali Hussein @0xanalyst]

9 years webshell EDR/AV/Yara testing samples left side screenshot improved to the right screenshot website using AI
https://t.co/4dOlmDiiv9
https://t.co/wPs7j3b8U9
#EDR #Defender #yara #webshell

[Ali Hussein @0xanalyst]

Interesting shift in DPRK tradecraft. from VS code extension abuse to crypto infrastrcuture for stealth C2 to github abuse https://t.co/sOlXhiGG5x. I published detection rules to detect this activity along with high fidelity AI assisted rules

#ThreatHunting #DFIR #Defender #ATP

[Ali Hussein @0xanalyst]

A new Redline variant
C2:
45.95.147.222:8080
185.215.113.117:443
91.215.85.45:80
194.36.191.128:8080
77.91.84.63:443
Exfil domains:
update.chrome-service[.]com
metrics.google-analytics[.]net
Yara rule:
https://t.co/s1HRUXqkLW
#Redline #Blueteam #Threathunting

[Ali Hussein @0xanalyst]

Based on https://t.co/rWi15LZbyH
I have added around 6 detection rules. from rustdesk to wbadmin credential dumping
https://t.co/z5x3ZvOL1J
https://t.co/OzEnokamVS
https://t.co/j3lMCWZMci
find the rules at https://t.co/gUrc46Dug2
#threathunting #Akira #ransomware #bumblebee

[Ali Hussein @0xanalyst]

Inspired by kqlsearch. my mentee @Qtr_Alhajj has built a Yara database and search engine here https://t.co/UnB1AduFgP. Incredible work from the first year university student. looking for suggestions to improve the website.
#Yara #database #malware

[Sam ☁️🪵 @Sam0x90]

With all the fuss around #velociraptor thought I'd give a shootout to project LOST (LOL Security Tools).
We started this together with @0xanalyst some time ago. Yes Velociraptor, osquery, defender, wazuh, and much more that would deserve to be documented
https://t.co/3vnGDLspty

[Ali Hussein @0xanalyst]

@r3nzsec @inversecos @1arwamo Stop ditching me @r3nzsec like your Saudi friend

[Ali Hussein @0xanalyst]

@r3nzsec @inversecos @XintraOrg How much I shall pay to be there?

[Ali Hussein @0xanalyst]

@_RastaMouse I didn't do any of your courses, but I can see that you are one way or another changing people's lives

[Ali Hussein @0xanalyst]

@_RastaMouse There are a lot of people out there depending on your courses, to build a career and learn stuff that they wont learn otherwise. That shall motivate you

[Ali Hussein @0xanalyst]

@r3nzsec @DebugPrivilege Well articulated Arabic responses.

[Ali Hussein @0xanalyst]

@r3nzsec @DebugPrivilege Hahaha

[Ali Hussein @0xanalyst]

@r3nzsec @DebugPrivilege I was waiting for you here.

[Ali Hussein @0xanalyst]

#Lumma #infosec #malware #blueteam #Threathunting

[Ali Hussein @0xanalyst]

New lumma variant
https://t.co/9Xl5OzxP1J
with tons of new techniques they use to obfuscate the malware
#Lumma #infosec #malware #blueteam

[Ali Hussein @0xanalyst]

This final execution of the malware seems a new way to obfuscate downloadstring dynamically. they load the ULR in a variable and then dynamically resolve function names for download and downloadstring
#Lumma #infosec #malware #blueteam
ChaGPT explanation follows

[inversecos @inversecos]

NEW LAB: Abu Jibal (APT34 / OilRig) 🔍💻

Iranian APT34 targets the oil and gas sector across the Middle East.

Test your blue team skills on:
👀 Password Filter DLL Attacks
👀 RunPE In-Memory Execution
👀 Windows Kernel Elevation
👀 Malicious JavaScript Payloads
👀 Custom Keyloggers

Lab Contributors:
Adversarial Emulation: @q8fawazo
Incident Response: @r3nzsec

Solve it here👉https://t.co/3yo41LBhOh @XintraOrg

[Ali Hussein @0xanalyst]

@r3nzsec @XintraOrg Abu Jibal hahhaha. Great work Abu Renzon

[FullHunt @FullHunt]

New FullHunt features coming up! Stay tuned…. 🥁🚀