Kyle Eaton

phishing, maldocs, threat intel

[Kyle Eaton @0xkyle]

Look, backtrack is still cooler than kali

[Kyle Eaton @0xkyle]

@KyleTDavis1 You’ve always been a joy to work with, and have given me good advice related to work/cyber and anything else I’ve needed help with. I know you’ll thrive wherever you land next

[Kyle Eaton @0xkyle]

@j2k3k Interviewers when I, literally Neo in the matrix, runs ssh on a nonstandard port

[Threat Insight @threatinsight]

Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint. 🫆

We use this tool internally to help track multiple threat actors with high confidence, improving attribution in many cases.

The tool has been released in the @Proofpoint Emerging Threats public #GitHub for other defenders to leverage.

Learn more about it here: https://t.co/I8IGC8mxCk

@ET_Labs #PDF #threatdetection #cyberthreat

[Kyle Eaton @0xkyle]

Another great year at @GrrCON! Big props to the staff for all the hard work they do 🫶

[Kyle Eaton @0xkyle]

I’ll be presenting at @GrrCON this year about some weird pdf detection ideas I’ve been messing with. Swing by and tell me your file format

[Kyle Eaton @0xkyle]

@ex_raritas It’s been really nice working with you, and good luck in your next role! 🐜

[Kyle Eaton @0xkyle]

@MalwareUtkonos @greglesnewich Oh that’s really good, especially considering all the other offsets are based from the eocd

[Kyle Eaton @0xkyle]

@MalwareUtkonos @greglesnewich I do really like that you’re using the filesize in part of the location check like that, I don’t know if I have any rules that use the filesize in that way.

[Kyle Eaton @0xkyle]

@MalwareUtkonos @greglesnewich Am I right in assuming that’s meant to make sure you’re only reading the eocd of the actual zip file and not any of the sub files? I have some rules where I’ve done something similar, I think it went something like: uint32be(@eocd[#eocd] + whatever) == 0xdeadbeef

[Greg Lesnewich @greglesnewich]

the biggest skill jump I took with yara was to think how the bytes within a file relate to one another

Malware isn’t a monolith - it’s a composite of bytes, and those bytes have to work together to do their job.

we can exploit those unique relations to track em

[Kyle Eaton @0xkyle]

@greglesnewich @MalwareUtkonos Definitely have to echo how impactful learning file formats was for improving my yara rules. How highly structured the
Zip format is makes rules very fun. The only sample rule I have rn is this old compression ratio one

[Kyle Eaton @0xkyle]

The PDF spec is where the phrase “bless this mess” originated.

[Proofpoint @proofpoint]

On this DISCARDED episode, we uncover real-world detection wins, explore persistent threats like #TA505 and #Emotet, and dive into the importance of instincts in cybersecurity—because, as our guest puts it, sometimes good detection is all about the vibes. https://t.co/stWpG8ubo7

[Kyle Eaton @0xkyle]

https://t.co/Tl8mp0dd9A

Also expecting to see indiandefenceforces[.]link soon

[Kyle Eaton @0xkyle]

Haven’t seen PDFs yet but new domain popped up: defenceindia[.]link

[Kyle Eaton @0xkyle]

Haven’t seen PDFs yet but new domain popped up: defenceindia[.]link

[Kyle Eaton @0xkyle]

departmentofdefence[.]link 🧐
Probably see PDFs using this soon

[Kyle Eaton @0xkyle]

@KyleTDavis1

[Kyle Eaton @0xkyle]

7c8a483f3c745d23db9557479bedbc6e458104c77709edc6907fa108065fc63a
PDF phish

[Kyle Eaton @0xkyle]

ministryofdefenceindia[.]link does not pass the sniff test.