NEE

0x90

[NEE @4pfsec]

@ItsRealAlec @grok done

[NEE @4pfsec]

@CRTkafa without the help of (prosperopatches etc.)

[NEE @4pfsec]

@CRTkafa Hey @CRTkafa just curious...how did you intercept a 14.22 console to get the pkg urls. cuz we need a 14.22 to be able to pre load it and if there's no JB for it, how did u get the URLs

[NEE @4pfsec]

🚨 THREAT ALERT 🚨 Our honeypot caught the #RedTail cryptomining botnet! 🛑

They used an exotic PHP LFI exploit (pearcmd.php) aiming to drop a web shell & hijack resources.

Read my full technical breakdown & IoCs here: 👉

#ThreatIntel #InfoSec #SANS_isc

[NEE @4pfsec]

@c3l3si4n looks interesting, thanks!

[NEE @4pfsec]

@billy_sec_ @0x64616e Don't think there's any unloading of drivers involved. Find a high priv acc > set new WDAC policy > reboot the box

[NEE @4pfsec]

@vxunderground i need this shirt !! ✊🏻🛜

[NEE @4pfsec]

@ly7ine @NicoleBeckwith aye i’m not alone i guess

[NEE @4pfsec]

@_JohnHammond @PlexTrac 😮

[NEE @4pfsec]

@akaclandestine @_JohnHammond dk how tru this is but p cool

[NEE @4pfsec]

@_JohnHammond it’s okay we can share costs !

[NEE @4pfsec]

@AntiCheatPD 🤔🤔

[NEE @4pfsec]

W~!
https://t.co/CiJxIWkO5e

[NEE @4pfsec]

@chinamanlive420 @_JohnHammond @0xTib3rius interesting, i’ll have to check this out later !

[NEE @4pfsec]

@_JohnHammond @0xTib3rius yeah that’s exactly what i thought too, saw a video from an ex blizzard employee explaining xss and cookies stealing. thanks john

[NEE @4pfsec]

@_JohnHammond @0xTib3rius saw a lot of people telling people not to launch csgo cus there was “xss” and extremely dangerous. but wasn’t it just the game client invoking web requests? there was no way someone could’ve gotten cookies from someone else’s main browser ye?

[NEE @4pfsec]

@_JohnHammond 😔

[Elliot @ElliotKillick]

I found out "C:\Windows\System32\WorkFolders.exe" (signed by MS) can be used to run arbitrary executables in the current working directory with the name control.exe. It's like a new rundll32.exe #lolbin but for EXEs!

[Elliot @ElliotKillick]

Need to go under the radar downloading #mimikatz (and other suspect payloads)? Then newly discovered #lolbin "C:\Windows\System32\Cmdl32.exe" (signed by MS) is for you. It's like a new certutil.exe but absolutely unheard of by any antivirus software!