あ

まじかー

[obscaries ❘ AppSec @obscaries]

HackLabs is a collection of hands-on vulnerable labs designed to practice web exploitation, privilege escalation, Active Directory attacks, and general pentesting techniques in a safe environment.

⚠️ For educational and authorized testing only.

🔗 https://t.co/yIKRr71ymP

#CyberSecurity #Pentesting #EthicalHacking #RedTeam #CTF #InfoSec #AppSec

[piyokango @piyokango]

米国CISAが発出したBOD26-04について、脆弱性対処の緊急度を判断する指標と各ケースにおける対処期限が参考になったので、指令中で示されたスケジュールを仮訳してみました。

[【公式】「デビル メイ クライ」シリーズ @devilmaycry_jp]

伝説のスタイリッシュアクション『デビル メイ クライ 5』が、オリジナル版の追加コンテンツを多数収録した決定版 ”デビルハンターエディション”としてNintendo Switch™2 に登場！

ダウンロード版は6月23日(火)、パッケージ版は8月28日(金)に発売予定！
#DMC5
#デビルメイクライ

[IntelOps @IntelOpsV3]

https://t.co/YC4ii76Xza by @CTI__Updates

Input a username and locate active forum accounts, very useful for your OSINT research or finding posts shared on X

[Mehmet Ergene @Cyb3rMonk]

This is big 🔥🔥 https://t.co/OOsaKt4PkG

[三輪信雄 @NobMiwa]

「Web攻撃、Active Directory、クラウド攻撃、エクスプロイト開発、EDR回避など9カテゴリの専門スキルをClaudeに提供します」

[International Cyber Digest @IntCyberDigest]

‼️ The open-sourced Miasma worm code includes a GitHub zero-day, and per the researcher who disclosed it, GitHub has known about it since September 8, 2025 and still hasn't fixed it.

Researcher Adnan Khan reported this exact technique to GitHub. Roughly nine months later it's now weaponized in the open-sourced Miasma code and running in the wild.

Khan's open question: how many GitHub customers were hit by the worm through it.

[Dark Web Informer @DarkWebInformer]

🚨🇯🇵 FamilyMart allegedly targeted in 21.5M record database leak

A threat actor on an underground forum is claiming to have leaked data allegedly belonging to FamilyMart, a major convenience store chain and retail brand.

The actor claims the dataset contains 21,581,576 records, including company planning data, payment records, agreements, employee information, and trade-related records.

𝗪𝗵𝗮𝘁’𝘀 𝗮𝗹𝗹𝗲𝗴𝗲𝗱𝗹𝘆 𝗲𝘅𝗽𝗼𝘀𝗲𝗱:

• Company planning records
• Payment-related data
• Agreement and contract records
• Employee information
• Trade-related records
• Advertiser and agency records
• Activity and schedule tables
• CSV database files

𝗗𝗲𝘁𝗮𝗶𝗹𝘀:

𝗧𝗮𝗿𝗴𝗲𝘁: FamilyMart
𝗖𝗼𝘂𝗻𝘁𝗿𝘆: Japan
𝗦𝗲𝗰𝘁𝗼𝗿: Retail / Convenience Stores
𝗔𝗰𝘁𝗼𝗿: tbabi / Anka Red Team
𝗖𝗹𝗮𝗶𝗺: Database leak
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: 21,581,576 records
𝗣𝗿𝗶𝗰𝗲: Not stated
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: May 22, 2026

Stop guessing what's redacted. Subscribers see everything: https://t.co/281Qjc6p2J

[Tom Dörr @tom_doerr]

Hands-on ethical hacking labs for students

https://t.co/LY2B2hRAqu

[rootsecdev @rootsecdev]

POC here:

https://t.co/6aGE7ams0c

[Joruno @wsl8297]

画网络架构图、给技术文档配图，很多人会用 Visio、https://t.co/G7X688igpg，但对技术小白来说，上手门槛总要花点时间。

在 GitHub 上发现一款更省心的选择：FossFLOW。专业等距（isometric）图表工具，完全开源，支持离线使用，上手很快。

它内置丰富的等距组件库，支持导入自定义图标，还配齐了自动保存、快捷键、多种存储方式等常用功能，做 3D 风格架构图很顺手。

GitHub： https://t.co/kWEnWa2eXu

主要功能：
- 等距图表绘制：快速产出 3D 风格技术架构图
- 自定义图标导入：支持 PNG/JPG/SVG，自动缩放适配
- PWA 离线支持：可安装为本地应用，随时打开就能用
- 隐私优先：数据默认本地存储，不出本机
- Docker 一键部署：支持服务器存储，多设备访问
- 自动保存：每 5 秒一次，尽量避免丢图丢进度

想用更直观的 3D 风格画架构图，可以直接跑 Docker 部署，或先体验在线 demo 再决定。

[Ridgeline Cyber @RidgelineCyber]

The detection rule that catches most BEC persistence (most still miss this one):

OfficeActivity
| where TimeGenerated > ago(1h)
| where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules", "Set-Mailbox")
| extend Parsed = parse_json(Parameters)
| mv-expand Parsed
| extend ParamName = tostring(https://t.co/NoT29gDyYJ), ParamValue = tostring(Parsed.Value)
| where ParamName in ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo", "ForwardingSmtpAddress", "DeleteMessage", "MarkAsRead", "MoveToFolder", "Name")
| summarize
RuleActions = make_set(ParamName),
ForwardDest = make_set(iff(ParamName in ("ForwardTo", " RedirectTo", "ForwardAsAttachmentTo", "ForwardingSmtpAddress"), ParamValue, "")),
RuleName = max( iff(ParamName == "Name", ParamValue, "") ),
ClientIP = max(ClientIP)
by TimeGenerated, UserId, Operation
| where RuleActions has_any ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo", "ForwardingSmtpAddress")
and (RuleActions has_any ("DeleteMessage", "MarkAsRead", "MoveToFolder") or array_length(ForwardDest) > 0)
// Optional: add your internal domains filter here to eliminate noise
// | where not(ForwardDest has_any ("@example.com", "@yourdomain.com", ...))
| project TimeGenerated, UserId, Operation, RuleName, ForwardDest, RuleActions, ClientIP
| order by TimeGenerated desc

Deploy this as a Sentinel analytics rule.
Run every 15 minutes. Alert on every hit.

This catches end-user inbox rules that forward to external addresses + hide/delete messages — the #1 BEC persistence trick.
(Pro tip: add your internal domains to kill false positives.)

This single rule would have caught the persistence mechanism in the majority of BEC cases we investigated last year.
There are other ways to address this, but the focus is on detection

[Threat Hunting Labs @ThruntingLabs]

New to Threat Hunting Labs?

We made the first investigation path easier to start.

Case 0001 is now free to run on the Azure platform for both:

- Threat Hunting
- Incident Response

That means new users can launch the guided walkthrough, use the Azure search console, run their first query, submit their first answer, and learn the core workflow without spending credits on the initial lab start.

The guided walkthrough now helps you:

- Launch Case 0001
- Work in Azure Log Analytics
- Run a starter query
- Submit your first answer
- Understand how THL investigations flow

This is the best starting point if you want to try the platform properly.

Start here:
https://t.co/EdI62I7Rba

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[Mehmet Ergene @Cyb3rMonk]

https://t.co/Ja3nrGf8T4

[Clandestine @akaclandestine]

GitHub - samftggr/VEN0m-Ransomware: Demonstrate how a signed driver can bypass defenses to deploy ransomware on Windows 11 with advanced AV and UAC evasion techniques. · GitHub https://t.co/bMPcb44YVI

[Justin Elze @HackingLZ]

CISOs should consider taking 30 minutes and reading a few random reports from @TheDFIRReport

https://t.co/IsUG5tv2Q2

[DirectoryRanger @DirectoryRanger]

VMkatz. Extract Windows credentials directly from VM memory snapshots and virtual disks, by @Nikaiw
https://t.co/RpdzUEdrLs

[yousukezan @yousukezan]

実は徳丸本のレビュアーだったりするんですよウソじゃないですよ

【徳丸本まとめ】Webアプリの脆弱性と対策を一気に整理する https://t.co/5FnZLStINR #Qiita

[yousukezan @yousukezan]

ThreatFoxで見つけた攻撃ツールキットをClaude Codeに食わせてバグバウンティ用ツールに作り変えた話｜ひよっこサウナ https://t.co/f7nk75WXL6 #zenn