Archie Pocsedio

Security Enthusiast, Threat Hunter, Purple Teamer, Technology Innovator, and Bibliophile

[Matthew Green 🌻 @mgreen27]

Interesting post I found last week looking into collecting locale and other data to fingerprint attacker RDP use.

Part1: locale and keyboard
https://t.co/wneZlr8Ke2

Part2: timezone and monitor
https://t.co/cqLpKz8PVz

#dfir

[Nathan McNulty @NathanMcNulty]

This is a great read, and it has some good mitigations listed

There are additional recommendations I would offer that I did not see mentioned, so I'll do my best to expound on this without giving away too much (you need to go read the article) :P

[Censys @censysio]

🚨 Malware infra is volatile.
~50% of Cobalt Strike servers vanish in 5 days.
~40% of Viper hides on port 60000.
🔎 Data freshness = critical. If you’re not tracking, you’re missing it.

Latest from Censys →
🔗 https://t.co/0oXvvIt3YG

#ThreatIntelligence #SOTIR #MalwareAnalysis

[Justin Elze @HackingLZ]

Neat a new tool from CISA

https://t.co/TkSVUflCAz

[Nasreddine Bencherchali @nas_bench]

Some uncommon logs worth looking at - https://t.co/VZDJhkApL3

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Did you know TypedPaths artifact can be helpful to detect the FileFix?

[Thomas Roccia 🤘 @fr0gger_]

🤓 If you want to learn more about MCP attacks or vulnerabilities, check out this project called Damn Vulnerable MCP.

It allows you to experiment on MCP server security through 10 challenges, from basic prompt injection to multi-vector attacks.

https://t.co/ny0jOAPJFk

[Craig Rowland - Agentless Linux Security @CraigHRowland]

The SCTP protocol on Linux provides a reliable and stealthy way to access Linux. In this thread I'm going to demonstrate a simple SCTP backdoor and how it can be missed by security teams. Then I'll show you how to look for this kind of activity.

[Nasreddine Bencherchali @nas_bench]

Introducing 🚀Eventlog Compendium 🚀

A new Streamlit app, that aims to be the go-to resource for understanding and playing with Windows Event Logs.

Explore it 👉 https://t.co/M8bHXpg8aL

Includes the following utilities and docs

⚙️ Build your own Advanced Audit Policy based on different data points making your policy data driven.

🧭EventID to Audit Policy mapping as well MITRE ATT&CK to Event ID explorer

📊Leveraging the EVTX-ETW-Resources project, you can explore the different ETW providers by build, version and filter down on key message strings.

📄 EVTX Baseline Search & Match - Explore the evtx-baseline project in a visual way. Where you can paste logs and check if they match in real time

🧮Event Field Decoder - Decode common Windows Security Event fields such as Logon Types, Access Masks, Active Directory GUIDs and SIDs

🔒Built-in SACL Explorer - leveraging SACL Scanner from Alexander DeMine, you can explore the built-in SACLs on a windows system.

And much more to come. Stay tuned

[Nextron Research ⚡️ @nextronresearch]

In the past few days we have observed an increasing amount of backdoored malware source code
releases on GitHub. The repositories were spread by multiple threat intelligence accounts on X.

The malware uses MSBuild project files with build events to execute malicious code. The observed malware uses a multi stage approach dropping multiple script based payloads, until eventually dropping an Electron based credential stealer.

We created a simple website as well as a script to help you identify these repositories.

Website
https://t.co/Fb3GnUCFWm

Source Code
https://t.co/1YgBMX2iyS

Example repo (malicious!)
hxxps[:]//github.com/Orshity/Batch-Malware-Builder-FUD-Crypter-AV-UAC-Bypass/

[Nathan McNulty @NathanMcNulty]

Most Microsoft tenants do not have Advanced Auditing configured correctly, and orgs only find out after it is too late :(

I tried really hard to make this as short and simple as possible. Please be nice to your IR folks and set this up, it's important ;)

https://t.co/NKtQGQJH1O

[Brian in Pittsburgh @arekfurt]

Windows Sandbox is a great Windows feature that has a great deal of potential.
A downside is that attackers--once they have already compromised a machine--can use it to better hide from security software.
This has resulted in some real world abuse.
https://t.co/FP7w5srw5V

[Nathan McNulty @NathanMcNulty]

So, uhh, this seems like something that is highly abusable that I bet almost nobody is monitoring for... :-/

https://t.co/eaXQ8p1437

[Thomas Roccia 🤘 @fr0gger_]

🤓 I don't understand why MCP (Model Context Protocol) took four months to get attention from the community, but I am glad it finally took off.

When it was released last November, I immediately saw its value for AI agents. That’s why I built an MCP server with ORKL right away to create a threat intelligence assistant.

MCP is basically a standard "for connecting AI assistants to the systems where data lives, including content repositories, business tools, and development environments."

So if you are interested to experiment with it for cybersecurity check out the following MCP:

➡️ ORKL MCP: https://t.co/oTKXApyJrQ

➡️ Shodan MCP: https://t.co/ObNz6BFrcu

➡️ VirusTotal MCP: https://t.co/2mbbwbghpw

➡️ Maigret MCP: https://t.co/TmCKT6NJRE

[x86matthew @x86matthew]

I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. https://t.co/KbsWfdLT3D

Project:
https://t.co/xJvm24qqXv

[Stephan Berger @malmoeb]

Among one of the techniques to detect infections, as laid out in my presentation and additional blog post "N-IOCs to Rule Them All" [1], is tracking lookups to Dynamic DNS (DynDNS) domains and providers.

Tony Lambert and Phil Hagen from Red Canary have done a similar investigation for four malware families. They are also of the opinion that tunneling and DyDNS providers should be blocked (where possible). [2]

It is double-edged. While there are certainly enough examples of legitimate services, there are also enough examples of malware and remote access trojans abusing them. Personally, if possible, I would follow Phil and Tony's recommendation and implement a DNS sinkhole-type control.

[1] https://t.co/llj7FKcR3y
[2] https://t.co/dBbUvrBuvU

[S3cur3Th1sSh1t @ShitSecure]

Using the search filter for Stars on Github is usually frustrating when you have lot's of stars. That's why I created my Pentest-Tools repo initially.

Well, there is an very easy way to automate creation of such a repo - without categorization 🙃

https://t.co/y2fGzlkcSg

[The Haag™ @M_haggis]

🚨 Everyone’s worried about PowerShell abuse… but Lua has been hiding in plain sight.

✅ No AMSI
✅ No telemetry
✅ No native logging
✅ Runs inside legit software

Attackers are already abusing it—game engines, updaters, even security tools.

PowerShell? Old news. The next EDR bypass isn’t in your logs—it’s running inside an embedded Lua script you’re not even monitoring.

It’s time to wake up. 💊

➡️ https://t.co/24YU5lC3PC
➡️ ThreatLocker: https://t.co/95FcGQcK53
➡️ ATT&CK T1059.011 https://t.co/jNsUkSOCJ1

[0x6rss @0x6rss]

hi threat hunters and malware analysts!
I want to introduce you to my newly developed tool called "Matkap".
with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs!
➡️ https://t.co/JVGcnQsWcR