DFIR437

The page finally refreshed, showing ten times more hosts matching « WINWORD.EXE LAUNCHING POWERSHELL.EXE »

[darkquasar @darkQuassar]

Hi guys, I know I've been absent but "Work & Life Balance" is not what it used to be! Anyways, check out the new post about WMI Persistence Detection with your SIEM:

https://t.co/tyknMsEj2T

[Simon Mourier @smourier]

#cominterop issues? Dude, what's this interface IID guid value? Introducing the new version of #magnumdb tool: https://t.co/m0sA7Pl76Y ("Magic Number database"), updated with #WindowsSDK version 10.0.16299.0 and more than 300.000 values!

[DFIR437 @CP437_DFIR]

Wow, discovered the double regex mode for awk, matching everyting between first and last regex, it's awesome !
Use the following to extract base64 certificates from raw binary stream :

awk '/^MII/,/=$/ {print $0}'

[DFIR437 @CP437_DFIR]

How could you learn #PowerShell ? a friendly piece of advice.

[DFIR437 @CP437_DFIR]

If all your 100K+ users aren't doing exactly what you don't want them to do, then it's only "Blue Team : A gentle introduction to Hell"

[DFIR437 @CP437_DFIR]

$(foreach($k in $(gci -re)){forEach($v in $k.GetValueNames()){[pscustomobject]@{p=$k.Name;n=$v;v=$k.GetValue($v);t=$k.GetValueK*($v)}}})

[DFIR437 @CP437_DFIR]

#powershell Windows Registry to CSV
> Learn what the clicky settings menu actually change on disk
> Check what malware did

[DFIR437 @CP437_DFIR]

" .doc " extension died 10 years ago with Microsoft Office 2007.
Have a nice day regexing Microsoft Exchange.

[DFIR437 @CP437_DFIR]

I'll attend the #Botconf

[DFIR437 @CP437_DFIR]

SEND HELP

[DFIR437 @CP437_DFIR]

We have hosts with no names.
https://t.co/LWFkxPtTpA

[DFIR437 @CP437_DFIR]

@forenslut @x0rz @pentesteur Et par quels moyens ? J'ai vu des trucs bricolés maison, (ex: dossiers nommés "IRP"), mais je me demande s'il existe d'autres usages.

[DFIR437 @CP437_DFIR]

@forenslut @x0rz @pentesteur Les entreprises françaises doivent protéger la confidentialité des données des IRP (syndicats).
Quel référentiel réglementaire impose ça?

[DFIR437 @CP437_DFIR]

Vous savez s'il existe un réglement spécifique aux IRP, similaire à matches(/PERSONNEL/) = NOPE ? @x0rz @forenslut @pentesteur

[DFIR437 @CP437_DFIR]

Chronopost - Suivi votre Colis.exe

😂

[DFIR437 @CP437_DFIR]

How can such a pointless information be highlighted so much ?

[DFIR437 @CP437_DFIR]

https://t.co/hg9UFHi4Eq :
wat is AS400 : 2 :
QPWDLMTADJ (prevents passwords with numbers next to each other, e.g., a password of 12345678)

[DFIR437 @CP437_DFIR]

Currently documenting on AS400 for some reason. There's so much questionable points that are triggering my spider senses.

[DFIR437 @CP437_DFIR]

legit.exe /VERYSILENT

[DFIR437 @CP437_DFIR]

Worst issue with homeworking is that you need to cook your own food :x