Half Full of Security

DFIR Dude

[Half Full of Security @GlassSec]

@4n6lady @d_mfn_b Side quests are where you level up your game. Often purely academic infosec professionals plateau during incidents because they reach their depth and wait for further instruction. Be your own teacher and teach yourself whatever you think is interesting. Side quests y'all

[Ali Hadi | B!n@ry @binaryz0ne]

First video about MBR drive layouts. #DFIR
"Fixing a Corrupted MBR Drive - Case #1"

https://t.co/TyHuysrwDB

[Half Full of Security @GlassSec]

@SwiftOnSecurity Haven't executed malware on my host machine before but I did set my VM up with folder sharing with my host profile (Documents, Downloads, etc) and then ran ransomware samples over and over again. Quite a learning opportunity for sure.

[proxylife @pr0xylife]

#Qakbot - azd - .pdf > .url > .zip > .img > .lnk > .cmd > .dll

(27.12.2022)

cmd.exe /c RulesChanges_SVX8.lnk

cmd.exe /c RecentInformation.cmd

rundll32 /s directcontract.dll,Updt

Samples 👇

https://t.co/ffWj85qdPR

https://t.co/z2YhMVdUwh

IOC's
https://t.co/YDnyhgrQDw

[Hasan Toor @hasantoxr]

Stanford University is offering free online courses.

No application or fee required.

Here are 5 FREE courses you don't want to miss:

[Hacking Articles @hackinarticles]

Best of OSCP Linux Command Cheat Sheet (Part 1)

Credit @fr0gger_

#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #redteam #informationsecurity #cissp #CyberSec #networking #networksecurity #CheatSheet #infosecurity #cyberattacks #security #vulnerabilities

[Half Full of Security @GlassSec]

Cyberchef, Python, Jupyter Notebooks, and Regular Expressions

[Paul Asadoorian @[email protected] @securityweekly]

How I run Linux as my desktop OS...

[Half Full of Security @GlassSec]

@malanalysis Hands down the worst MCU movie to date.

[Germán Fernández @1ZRR4H]

#Qakbot post-compromise discovery commands:

net view
cmd /c set
arp -a
ipconfig /all
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
net share
net1 share
route print
netstat -nao
net localgroup
whoami /all

#recon #discovery

[Paul Asadoorian @[email protected] @securityweekly]

The difference between Windows and Linux...

[DFIR Diva @DfirDiva]

I just updated the Incident Response Training Plan using free courses, starting from complete beginner to IT.

(Fixed broken links, replaced/added courses, removed things that were no longer free)

https://t.co/XwxajOYin6

#DFIR #incidentresponse

[Dr. Tech @doctechmd]

Programming meeting

[Beto ⚽️👨‍💻🇲🇽 @RickHunter7]

McAfee antivirus 😅

[Renzon @r3nzsec]

ZIP > ISO > .LNK > Bumblebee .dll file > Cobalt Strike > AnyDesk > Adfind > VulnRecon > Procdump > Seatbelt > Invoke-kerberoast.ps1 > PS Cobalt Strike payload > Lolbins

What a great report to start our Monday! Thanks, @TheDFIRReport, as always! #dfir

https://t.co/NRW5dFZGTe

[Bryce @bryceabdo]

the SOC when an alert for suspicious powershell usage hits the queue

[Half Full of Security @GlassSec]

@ItsDanaWhite Money.

[Half Full of Security @GlassSec]

@malanalysis Just to clarify...this is not a marital aid?