Andurin

IT-Security, Cyber Threat Analyst

[Andurin @4ndur1n]

@jaydinbas @Vimeo Nowadays this seems to have a name "EMPTYSPACE":

https://t.co/k2J4TeETqn

https://t.co/UfpyPDv2Jn

[Andurin @4ndur1n]

@botlabsDev @DEATHCon2024 As far as I know @botlabsDev expect at least one slide around testing your tools 🥰. But also I would bet on an interesting workshop and maybe also fresh ideas.

[Florian Roth ⚡️ @cyb3rops]

Repeat after me:

Patching an already compromised system won’t solve the problem

#PaloAlto

[Scott Piper @0xdabbad00]

CISA is requiring all Federal agencies to disconnect Ivanti products by Friday at midnight (Ivanti Connect Secure & Ivanti Policy Secure). This is roughly 48 hours notice, to not patch, but rip it out! Ivanti is an American company. This is unprecedented.
https://t.co/cJZRuHHF5o

[DCSO CyTec @DCSO_CyTec]

Our newest article provides a closer look at recent reporting on Volt Typhoon's "JDY" botnet management, which suggests that the threat actor uses Tor differently to what has been publicly documented so far.

https://t.co/hHcJIu8d70

[John Althouse @4A4133]

I'm looking to contract someone who can convert JA4+ into Zeek scripts. Anyone know of any Zeek experts who could take on the effort?

[DCSO CyTec @DCSO_CyTec]

#ShortAndMalicious
Our researchers recently discovered an installer for the mandatory 🇷🇺Russian tax filling software "Spravki BK" (Справки БК) which was backdoored with #KONNI malware, generally attributed to 🇰🇵North Korean threat actors. 1/5

[Andurin @4ndur1n]

@CERT_at "... eine Notwasserung der Beinkleider zu veranlassen."
Thank you - this made my day.

[sigma @sigma_hq]

We're pleased to announce the launch of our new website

Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard

Special thx to @sifex for the hard work!

Blog: https://t.co/O5Ewz0oHKL
Explore now: https://t.co/hg6AgdBS3Y

[Andurin @4ndur1n]

@DefensiveDepth Thanks. Guess it is time for a updated AND Course? 🤗

[Andurin @4ndur1n]

👇
https://t.co/vgVVHjTQ6d

[Andurin @4ndur1n]

Elasticsearch keyword searches are fast and fine but misses case-insensitive searches. Event-Query-Language (EQL) sounds like a valuable answer for many security related use cases.
Today I'm allowed to release pySigma-backend-elasticsearch (v1.0.8 ) with a EQL Support.

@sigma_hq

[Alex @alexanderjaeger]

🕶️🧐👀🥷🥁A new project by the Security Response team of @Google: https://t.co/fTO9MvhPBa. It fills a gap I have seen for years, asking the same questions in similar investigations across analysts who might have different background and know how. 🕶️🧐👀🥷🥁

[abuse.ch @abuse_ch]

SERVICE UPDATE | Today, Twitter has revoked our access to their authentication API. The impact is submissions to the https://t.co/x0TWKNn9PP platforms cannot be made. We are urgently working to find a different authentication method. Please bear with us - we'll update again once we're up and running.

[Andurin @4ndur1n]

@jaydinbas @MsftSecIntel #oopsie

[Florian Roth ⚡️ @cyb3rops]

How to piss off X using 6 words maximum?

[Florian Roth ⚡️ @cyb3rops]

For anyone asked to pay $$$ for a compromise assessment with the #3CX IOCs & YARA rules

You can use the free THOR Lite scanner to do the same. (it should even detect traces of the activity, like C2s in log files etc; Sigma scanning only in full version)

https://t.co/gG1xDLRnjz

[Andurin @4ndur1n]

@nerdbert @Materna_SE Der ist abgesagt worden.

[Andurin @4ndur1n]

@Cyb3rMik3 @MITREengenuity Congrats and welcome to the Club. Imo SOC Assessment was challenging and also very valuable. For 500USD realy knowledge about the framework.

[Andurin @4ndur1n]

@Rastar_Group just want to say "thank you" for your cardboard packaging wishes.