Dale Pippin

Glutton for Knowledge | Malware Enthusiast | Lethal Forensicator | Yacht Rock Junkie | Star Wars Trivia Scholar

[Ramin Nafisi @MalwareRE]

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

[Jake Williams @MalwareJake]

This is what I picture every time an exec demands domain admin - absolute recklessness...

[Dale Pippin @DaleDoesInfoSec]

@BoysenAggie10 Haha love that video

[Cutter @cutter_re]

We just released Cutter v1.9 on #r2con2019 with a HUGE surprise -
a full integration of Ghidra decompiler in Cutter! 🥳

Download v1.9 with the Decompiler from https://t.co/BTHs8EYTKs

For more info, keep reading >>

[Florian Roth ⚡️ @cyb3rops]

Inside the APT28 DLL Backdoor Blitz

https://t.co/YpTyioUPVY

[Steve Lee @Steve_MSFT]

Coming in #PowerShell7 Preview.3 is `ForEach-Object -Parallel` experimental feature! Easily execute scriptblocks in parallel threads! https://t.co/UK7GLaZ0Fw

[Eric Zimmerman @EricRZimmerman]

MFT Explorer is now on https://t.co/Mp6LstLVO2 and will show up via Get-ZimmermanTools.ps1 #DFIR

[Robert M. Lee @RobertMLee]

5 Things ICS Operators and Critical Infrastructure Must Do in the Face of Cyber Escalation https://t.co/DtSsqO1Mvt > new blog given increased tensions and an upcoming webinar this week with advise by @cnoanalysis

[Khalil @sehnaoui]

Stack Overflow releases its own keyboard.

[Scott Hanselman 🌮 @shanselman]

🚨You can now download the new Open Source Windows Terminal 🚨https://t.co/7ZMXk7krV3

[Eric Zimmerman @EricRZimmerman]

In the next version of KAPE, the minimum .net requirement has been LOWERED to .net 4.5 which means it will run in many more places! #DFIR

[Andrew Case @attrc]

This research is a good example of why memory forensics is so important.

@volatility 's ldrmodules plugin automatically reports such manipulation due to its comparison of data in the VAD vs the PEB

1/2

[John Lambert @JohnLaTwC]

This malicious #Python script downloads a cross-compiler for 14 different CPU architectures to compile its backdoor!

▪️https://t.co/4pdNmemKE1
▪️https://t.co/y9cRI5qiAE

[Dale Pippin @DaleDoesInfoSec]

@SANSNetWars For DFIR NetWars: If (when) you get stuck on a question, don’t spend too much time banging your head against a wall. Go to a different question/domain, get some wins, and come back to the problem question later. Rabbit holes will kill you

[Dale Pippin @DaleDoesInfoSec]

Crouching Kernel, #HiddenWasp

[Eric Zimmerman @EricRZimmerman]

Introducing KAPE!

#DFIR
https://t.co/82HigKCw7B

[Chad Tilbury @chadtilbury]

While us slackers were sleeping, @EricRZimmerman added locked file / live response support to to AmcacheParser, AppCompatCacheParser, MFTECmd, ShellBags Explorer, SBECmd, Registry Explorer, and RECmd https://t.co/1GUT6ShsMc

[Shodan @shodanhq]

The $5 Black Friday sale is returning and available from Friday through Monday

[Dale Pippin @DaleDoesInfoSec]

@BwadWilliams @totalfratmove @brittbluestein @brettcrenshaw Looks about right 😂

[Dale Pippin @DaleDoesInfoSec]

@BwadWilliams 😂 I would have thought the same thing