Murphy the Malware Lab

Insight from a cybersecurity professional and his faithful Chocolate Labrador. Opinions presented here do not reflect the views of any company or client.

[Murphy the Malware Lab @MalwareLabMurph]

Hello World! I decided to start this Twitter account to keep up with current cybersecurity research, analysis, and threat intelligence, as well as interact with other professionals in the field. I’ll do my best to signal-boost posts that I feel will benefit the community!

[Tom Jøran Sønstebyseter Rønning @L1v1ng0ffTh3L4N]

Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

[BleepingComputer @BleepinComputer]

Microsoft announced today that it will integrate Sysmon natively into Windows 11 and Windows Server 2025 next year, making it unnecessary to deploy the standalone Sysinternals tools.
https://t.co/aomlKYXm5Q

[Murphy the Malware Lab @MalwareLabMurph]

Apparently I’ve avoided this app to the point where it no longer is confident I’m a human… or perhaps my alter-ego is more convincing than I realized? 🤖🐶

[Florian Roth ⚡️ @cyb3rops]

People know me for strong opinions on offensive security, threat intel, malware devs, C2 frameworks.

Now it’s time to piss off the defenders.

Process Creation logs (Event ID 4688) are the only sane answer here.

Not DNS query logs. Not PCAPs. Not network logs with login events and failed attempts. That’s just low-context noise or IOC-driven retro-hunting.

PCAPs are fine if you like staring at packets for hours to find a weird TLS handshake. DNS logs? Useful if the attacker was dumb enough to use known domains.

4688 gives you actual behavior. Suspicious subprocesses. Malicious chains. New stuff. Generic patterns.

You can have a different opinion. Doesn’t make it less wrong.

[Murphy the Malware Lab @MalwareLabMurph]

I’m still here!!! The burnout has been real, but every now and then I see a glimmer of light when somebody asks me about a real cybersecurity topic. 😌

[Murphy the Malware Lab @MalwareLabMurph]

Trying to do my obligatory semi-regular login and doom scrolling… this place still as toxic as i remember? ☠️

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372. Storm-2372’s targets include governments, NGOs, IT services and technology, defense, telecoms, health, higher education, and energy/oil and gas in Europe, North America, Africa, and the Middle East. Microsoft assesses with medium confidence that Storm-2372 aligns with Russian interests, victimology, and tradecraft.

Our ongoing investigation indicates that this campaign has been active since August 2024, with the actor creating lures that resemble messaging app experiences including WhatsApp, Signal, and Microsoft Teams. In device code phishing, threat actors exploit the device code authentication flow to capture authentication tokens, which they then use to access target accounts, and further gain access to data and other services that the compromised account has access to.

Read our research on the active threat represented by Storm-2372 and other threat actors exploiting device code phishing techniques, and get detection and mitigation guidance: https://t.co/D0FHTJVuGF

[Dark Reading @DarkReading]

ICYMI: Trump administration axed all advisory committee members in DHS, including the people that make up the Cybersecurity and Infrastructure Security Agency's (CISA) Cyber Safety Review Board (CSRB). https://t.co/MinZKNK5LP

[Katie Nickels @likethecoins]

We're just two weeks away from the SANS CTI Summit, one of my favorite conferences of the year! I've seen several presentation drafts, and they are 🔥. Register today to join Live Online (free!) or in-person in Alexandria, VA!
➡️ Register: https://t.co/uBkLbdD167
@sansforensics

[Murphy the Malware Lab @MalwareLabMurph]

Admittedly I’ve been quiet on here lately due to general holiday hectic household, but I always recommend and make it a point to complete this challenge every December!

[TryHackMe @tryhackme]

#AdventOfCyber is HERE! 🚨🎅
🔗 https://t.co/N37yYGq4Gb

Take on daily beginner-friendly challenges throughout December to be in with the chance of winning from our $100,000 prize draw 🎁🎄

[TryHackMe @tryhackme]

#AdventOfCyber is HERE! 🚨🎅
🔗 https://t.co/N37yYGq4Gb

Take on daily beginner-friendly challenges throughout December to be in with the chance of winning from our $100,000 prize draw 🎁🎄

[Murphy the Malware Lab @MalwareLabMurph]

@_JohnHammond 🦃 @NahamSec - thanks for the opportunity!

[John Hammond @_JohnHammond]

BEN SAID I COULD DO A GIVEAWAY TOO 🥳

HackingHub Black Friday deal: https://t.co/Uf3mW11mcR

$39 for lifetime access ♾️
OR
$19 for a month trial ⏰

AND I can match his giveaway--
2️⃣ WINNERS (1 each)
- Full cert bundle
- Lifetime access

To enter: ↪️ retweet and reply w/ 🦃

[Thomas Roccia 🤘 @fr0gger_]

📢 The Github Infosec Black Friday 2024 edtion is out!! Already some good deals here 👇

https://t.co/1QwI2QCygb

[Murphy the Malware Lab @MalwareLabMurph]

Very cool! Excited to explore this further at work!

[Kostas @Kostastsale]

I created the first draft of a website for the EDR telemetry project to help people quickly compare vendor telemetry visibility. What do you think about it? Are there any specific features you want to see for the website?

Built with ChatGPT 4o with canvas (wanted to test it out😂)

EDR Telemetry project 🔗: https://t.co/8DmXzffYVC

[Murphy the Malware Lab @MalwareLabMurph]

Topic that arose while discussing Kindergarten career day: anybody have experience/resources on how to explain InfoSec to children? Would be intrigued to see any resources/talks… otherwise I may just need to make my own… 🤔

[Florian Roth ⚡️ @cyb3rops]

What people often overlook in #DetectionEngineering is that there’s no "one-size-fits-all" rule to detect a threat. It depends on your goals.

How specific should the rule be? Are you tracking a threat actor, detecting the tool/malware, or focusing on the technique? Should it be based on code, content, form, or metadata?

Just like in art, you can create an abstract, impressionist, or realistic painting of the same subject, and all can be masterpieces in their own right

[Rachel Tobac @RachelTobac]

If your family hasn’t received a phone call from “family” saying they’ve “been in an accident and need money for bail”, they likely will in the next few years.
This AI voice clone scam is so easy to make and I’ve had folks left and right telling me they’re getting these calls.

[Murphy the Malware Lab @MalwareLabMurph]

@klrgrz @Unit42_Intel Do I need prior experience engaging in cyber crime to be considered? 😸