Alexander Rausch

[Alexander Rausch @ReleasePreview]

Twitter is dead, long live bluesky

Follow me on @geheimoperation.bsky.social

[Alexander Rausch @ReleasePreview]

@re_and_more Another tip to maybe save folks some time. Sometimes shellcode assumes the presence of certain libraries in memory. If you see segfaults with ip=0 this can be an indicator that some dynamic import code broke due to using GetModuleHandleA or PEB loaded modules for library imports.

[Alice Climent @AliceCliment]

Curious about what's happening in the Windows Kernel after a Syscall?

I just wrote this post following the worfkflow from the Syscall instruction to the target kernel routine ⬇️

https://t.co/PDc5eXZCyk

Thanks again to @Set_hyx for the proofreading!

[dinero @dinqr0]

fresh and spicy meme off the grill for game hackers

[Threat Insight @threatinsight]

Following CERT-UA reports of phishing targeting ukr[.]net accounts of Ukrainian military personnel, Proofpoint identified a suspected compromised ukr[.]net account sending an evacuation themed malicious Excel document to a European government.

[Katie Nickels @likethecoins]

As you're reading this, note this point: adversaries likely had control of the AD server already. They were already in. There's a broader intrusion chain beyond just the wiper, it just isn't publicly known yet. I'm watching for any details on what happens BEFORE wiper deployment.

[Axel Souchet @0vercl0k]

9 years ago I released my first project on GitHub: 'rp++' yet another ROP gadget finder 😊

I've finally carved out time to clean up the codebase and push the v2, check it out 🔥!

https://t.co/mnKlNwjZZl

[Threat Insight @threatinsight]

Emotet returns to email after an 18 day break with a new URL format and personalized landing pages. #Emotet #malware #cybercrime

[Timo Steffens @Timo_Steffens]

APT31 is one of the most relevant attacker groups for political organizations in Western Europe.

This report contains details about the later killchain phases that were not yet publicly known.
Also some insights into the backdoor that controls the routers for anonymization.

[💻 Sherrod @sherrod_im]

We are #hiring Sr. Threat Detection Engineer https://t.co/rqnzCGdo7B You like PCAP? We got it. Write IDS rules for the Snort and Suricata platform.
Work with the open source community to maintain the ETOpen ruleset.
Research malware, exploit kits and vulns. #infosecjobs

[Konstantin Klinger @kk_onstantin]

Check out our latest presentation "Making CENTS of Malware Configurations" with @malwareforme and @zoomequipd at #SuriCon2021 bringing automated @ET_Labs rules to @CapeSandbox
https://t.co/n5kbAkEhKs
https://t.co/T5U59C0aYA

[LiveOverflow 🔴 @LiveOverflow]

I have some thoughts about https://t.co/AfXbh35cf7

They are claiming to make a scientific contribution with a novel class of vulnerabilities.
But that is not really true. Thread 🧵

[Jonas L @jonasLyk]

Wanna disable Defender when enabled Isolated Core and Tamper protection?

Its a bit more trouble- but doable, without ruining Isolated Core/Secureboot etc.

Defenders process will run as a unkillable protected service- so new tricks needed.

Here we go:

[Alyssa (she/her) @ramen0x3f]

Alright, folks, let's talk about Cobalt Strike!
https://t.co/v2gmWXp5CO

(Sorry, red team pals. This one is for my defense buddies!) 🧵

[LiveOverflow 🔴 @LiveOverflow]

NEW Phrack issue #70 is out!
I wrote an article about the "YouTube Security Scene"
https://t.co/QD2eboxkCo

[Florian Roth ⚡️ @cyb3rops]

My teammate @_humpalum published a script for #010Editor that takes the currently selected bytes and puts them in a @virustotal "content"-search

We recommend assigning a keyboard shortcut to access it more quickly

https://t.co/q3CpOcGwe9

[Kirk Soluk @KirkSoluk]

Hi all,

Great reversing opportunity here at Proofpoint. Fully remote. Awesome team.

https://t.co/VauKGgFHjo

#reverseengineering #infosec #cybersecurity

[Maddie Stone @maddiestone]

The exploit developer that Kaspersky tracks as "Moses" is Exodus Intelligence...

From Kaspersky: "we believe at least six vulnerabilities observed in the wild in the last two years have originated from Moses"¹

https://t.co/aUTkJL9POC

¹ https://t.co/lCdPNvb4kl

[j00sean @j00sean]

Thanks to @revskills for a cool idea, CVE-2021-40444 reached over most of Windows browsers. 2 clicks needed to exploit this. This chain uses a new bug i've just informed to MS hours ago and patches for affected browsers incoming soon. Further details once fully fixed.

[j00sean @j00sean]

I'm too late at CVE-2021-40444 party. But i just wanted to take a look at MSIE exploitation. Awesome to see a full exploit (RCE w/ sandbox escape) only using 6 lines of javascript code. Cool no doubt.