Mat Gangwer

Threat Hunting | DFIR | SECOPS | Defender against the Dark Arts | VP, Managed Threat Response @Sophos | Previous: Co-Founder @RookSecurity

[Mat Gangwer @MatGangwer]

@NeilJacobs Good thing I listened to 2011 Mat.

[Will @BushidoToken]

⚠️Emerging Ransomware or data-theft-extortion groups to track:

🔒💰
AlphV/BlackCat (written in Rust)
Quantum (XingLocker variant)
Rook (Babuk variant)
Entropy (linked to Dridex)
NightSky
HolyGhost
RobinHood
Admin Locker (no leak site)

📂💰
Karakurt
Hotarus Group
Lapsus$

[Mat Gangwer @MatGangwer]

@BlaineOh @rogredhat @mrd0x @Sophos I didn't want to end the conversation while we investigate without a near-term solution for you. This DataLake query can be setup on a schedule to identify potential abuse of ProcDump. It looks back 2 days for the suspicious flags mentioned. https://t.co/9gVVGdmhN8

3/3

[Mat Gangwer @MatGangwer]

@BlaineOh @rogredhat @mrd0x @Sophos I would still standby my initial assessment that the original reported bypass (folder/path) is prevented, and this is a different method altogether. That being said, knowing and understanding visibility and prevention limitations is still critically relevant.

2/3

[Mat Gangwer @MatGangwer]

@BlaineOh @mrd0x Please do. I’m happy to provide any help if you need it. I saw the screenshot you shared and will try in the lab with those options.

[Mat Gangwer @MatGangwer]

@BlaineOh @mrd0x Would you be able to validate the policy being applied?

With "Prevent credential theft" enabled, I'm observing LSASS access being blocked as expected. There is not an alert that will pop-up, but no file will be written.

Full Disclosure: I work at Sophos

[Mat Gangwer @MatGangwer]

@ShawnAxsom 👋 would be happy to be of assistance, if I can. My DM’s are open!

[Mat Gangwer @MatGangwer]

@blueteamblog Yeah - this is an excellent post. Thanks for sharing

I'm thinking we extract specific examples of each technique we identified in our article and dive into what we observed, how we detected it, and how we responded.

[Sophos X-Ops @SophosXOps]

Read the full report from @john_shier, @MatGangwer, @secbug, and @AltShiftPrtScn :https://t.co/19Yr9RW9U6

11/11

[Mat Gangwer @MatGangwer]

@reegun21 There definitely hasn’t been enough discussion around this aspect of investigating the script output.

Do you have any log samples of the exploit being successful in extracting email messages?

Thanks for sharing.

[Mat Gangwer @MatGangwer]

Stop by booth 152 @SecureWorldExpo #SWSEA17 to talk with @rooksecurity about Managed Detection and Response #combatready

[Mat Gangwer @MatGangwer]

Come see @rooksecurity at @SecureWorldExpo booth 431 to talk managed detection and response

[Sophos Threat Hunters @rooksecurity]

A huge congratulations to @TGorup for being named among the #Tech25! Another fantastic event and awards program from the @TechPointInd team.

[TechPointInd @TechPointInd]

Apply today - @rooksecurity is hiring an entry level 3rd Shift Security Analyst https://t.co/P5SNOEDT39

[Mat Gangwer @MatGangwer]

https://t.co/rVQO27Hi2g We are looking for a #python #django product engineer to join our team and help build innovative security products.

[TechPointInd @TechPointInd]

Apply today - @RookSecurity is hiring a Software Product Engineer https://t.co/4z9wsnh3Fx

[Mat Gangwer @MatGangwer]

We have an opening for a #Python #django Product Engineer. Apply to see what we've been working on! @rooksecurity https://t.co/S7xczn9u1f