Doomdesire

Detection Engineering/Threat Hunting

[Doomdesire @DoomdesireEU]

@TheRealShiroe fre.php 😂

[ge0lev @ge0lev]

#Lumma #Stealer #Malware
Steam Profile Page https://t.co/pykCP2HDAi

Containing ROT13(Amount 15) encrypted domains

[Olaf Hartong @olafhartong]

Based on some discussion during one of our training exercises I've created this simple tool to calculate TGT TicketOptions in Hex, Binary and Decimal. It may be useful to you too ;)

https://t.co/Nl8XoEJvcS

[Doomdesire @DoomdesireEU]

New post: Manipulating IBM QRadar Windows Default Properties https://t.co/jsrPuZh7lW

[Sean Metcalf @PyroTek3]

In today's WTF?!?!? moment

When a ESXi server is domain-joined, it assumes any "ESX Admins" group & its members should have full admin rights.

So.... anyone who can create & manage a group in AD, can get full admin rights to the VMware ESX hypervisors!
https://t.co/U3DiXHWQMR

[SpecterOps @SpecterOps]

In our #purpleteam service, we take a depth & quality approach & run many diverse test cases for a given technique. In our latest blog post, @gwhitekc walks through the process we use to define & implement the test cases for our purple team runbooks. https://t.co/KWHrOA8KZI

[Marshall';--🐼🍌 @MJHallenbeck]

Updated the NetExec Recall PR to parse the DB file for window & content text, then you can grep on them.

[Kostas @Kostastsale]

Check out this awesome report by Sophos on Chinese APT threat actors. There is much to learn from this technical breakdown; it's not your ordinary threat actor.

Reading this report, you will notice that they used tools like impacket for lateral movement, which provides an opportunity for detection.

➡️Interesting use of Living-Off-the-Land binaries that I personally haven't seen before - instsrv.exe and srvany.exe.
➡️Multiple defense evasion methods to hide their tracks and evade detection, including a clever way to read DNS traffic and block AV/EDR-related domains. (but still uses impacket 🤷‍♂️🤦‍♂️)
➡️Interesting choice of data being staged for exfiltration.

Overall, this prolonged intrusion had everything, and the authors did an incredible job of laying out all the details for the rest of the community. 🙏👏

Check it out here 🔗: https://t.co/1ZieUUd6w2

[Doomdesire @DoomdesireEU]

@nas_bench From my experience there are orgs that will provide feedback, what we detected and what not and how we can improve. On the other hand, you have orgs telling you they have a red team in a specific timeframe, tell you "ignore any alerts" and you never hear about it's results again.

[Nasreddine Bencherchali @nas_bench]

When you tell a red teamer to stop releasing stuff that enables threat actors 😂😂.

[Doomdesire @DoomdesireEU]

@_JohnHammond @HuntressLabs For the IIS logs, shouldn't it be cs-uri-stem instead of cs-uri-query in the Sigma rule?

[Andy Robbins @_wald0]

Partner Tier2 Support is an attractive role for adversaries installing a backdoor in Entra:

● Can promote self to Global Admin
● Role is invisible in Entra ID portal
● Built into every Entra tenant

Read more here: https://t.co/DpY84MH3Nt

[Nathan McNulty @NathanMcNulty]

Hahaha, wow, hiding the "Stay signed in?" prompt for Entra ID requires a license... 🤯

[Shiroe @TheRealShiroe]

https://t.co/XPTXCj9opT

My first blogpost ! Really happy that I finally found the time to finish it. Hope you enjoy and suggestions are welcome.

[Doomdesire @DoomdesireEU]

@vxunderground @InvictusIR Nice!

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified new Qakbot phishing campaigns following the August 2023 law enforcement disruption operation. The campaign began on December 11, was low in volume, and targeted the hospitality industry. Targets received a PDF from a user masquerading as an IRS employee.

[Justin Elze @HackingLZ]

This is infuriating when MS detects something and could block by default but you didn’t pay enough.

[Doomdesire @DoomdesireEU]

Some proxy hunting regex for #BunnyLoader based on ZScalers post:

Proxy Urls: \/Bunny\/\w+\.php
User Agents: (?i)(Bunny(?:loader(?:_dropper)?|requester|tasks|stealer|shell)|TaskCompleted|HeartBeat_sender)

Reference: https://t.co/4Orwq62kza

[Doomdesire @DoomdesireEU]

New post: Hunting for PurpleFox Exploit Kit

https://t.co/F0j4ptZlRf

[Doomdesire @DoomdesireEU]

FYI: Since the release of VMware Carbon Black Cloud Windows Sensor 3.8.0.398, you can search for API information on cross process events with crossproc_api field.

Example: Searching for MiniDumpWriteDump API call to detect LSASS dumping.