221BlueStreet

Security Researcher @ Palo Alto Networks

[221BlueStreet @SaharShukrun]

@inspector_il כנראה שלא צריך הרבה שכל כדי להחזיק מניות של פאלו אלטו, זאת החברה עם הכי הרבה נשים בהייטק בכל תפקיד שאתה תראה, חלאס עם לפרסם גיוון לשם הגיוון, סתם לשקר כדי שיהיה לך נעים בעין? זה גיוס לצוות ספציפי שבו יצא שיש רק גברים כרגע.
ממתי רק גברים הפך להיות מילה גסה?
איף

[221BlueStreet @SaharShukrun]

Just finished @codemachineinc 's Windows Rootkit Techniques course, hands down, the best training I've ever taken.
I recommend to anyone to attend at least one of T.roy's courses during his lifetime.

[221BlueStreet @SaharShukrun]

A Thousand (4) ways of COM Hijacking explained :)
https://t.co/c4qTvjw460

[221BlueStreet @SaharShukrun]

@bohops Hmm, probably a default value in regards to the process name, however, you have plenty more information regarding the executable so that shouldn't matter that much, I didn't get the second part of the tweet, is there still value in what?

[221BlueStreet @SaharShukrun]

If you guys are into Windows Component Object Model (COM) ; or always wanted to understand it, I've made a nice primer for COM, very detail with many examples to cover the black magic that surrounds this tech :))

https://t.co/mpObS9EOBI

[221BlueStreet @SaharShukrun]

@BlackMatter23 @jaredcatkinson Well, that's a hard one, because as an "Analyst" you do want raw data, but sending all of the data and EDR collects is very expensive and sometimes not competitive, and so EDR vendor now limits the amount of data sent to the cloud because it increases the cost of the product

[Alice Climent @AliceCliment]

I've just discovered this amazing document showing super clearly the relation between the opcode and the instruction 🤯

https://t.co/4TrQM0Y65u

[Charlie Bromberg « Shutdown » @_nwodtuhs]

Active Directory "WriteOwner" DACL abuse, now in Python 🐍

https://t.co/waU2eWdfPW

And icymi, "WriteDACL" abuse, also in Python now 🐍

https://t.co/nQGZy1dnbR

One DACL abuse is left implementing, "Logon script"

[221BlueStreet @SaharShukrun]

@rimpq Protection results are also worth noting as these block the scenarios

[Roberto Rodriguez 🇵🇪 @Cyb3rWard0g]

🚨 #Python for security investigations, research & threat hunting?

🪵 Collect 👔 Enrich 🔍Analyze & 📊Viz data!

💸 oh.. & for free! open source!

The amazing @ianhellen @MSSPete @ashwinpatil 'll show how to w/ MSTICpy 🔥@BlackHatEvents #BHUSA

Arsenal: https://t.co/MCgLDpfay1

[221BlueStreet @SaharShukrun]

#persistence #evasion #VBA #Macro #malware

[221BlueStreet @SaharShukrun]

Instead of leveraging VBAWarning:1 to disable macro warnings, you can use the TRUST mechanism to "disable" all security mechanisms by adding a "Trusted Location" or "Trusted Document" entry.

HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Security\Trusted Locations\Location01\<path>

[221BlueStreet @SaharShukrun]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\Trusted Documents
=======
You can also specify the trusted path as "C:\"
and add a value that trusts all sub-folder of the trusted directory:
...\Word\Security\TrustedLocations\Location01\AllowSubFolders

[221BlueStreet @SaharShukrun]

Super Excited :D:D

[Roberto Rodriguez 🇵🇪 @Cyb3rWard0g]

🚨 Organizing an Infosec Jupyterthon on 5/8 🚀 An open virtual community event for security researchers to share their favorite @ProjectJupyter #notebooks w/ the Infosec 🌎 Share & meet other Infosec Jovyans!

Site: https://t.co/cc65ItM4gl

Call for 📔: https://t.co/XzApZkwUsq

[221BlueStreet @SaharShukrun]

A lot of new #cloud techniques were added to #mitreattack matrix, along with additional new and updated techniques.
In the update you can even find my own recent contribution regarding the office persistence technique I recently published an article about
https://t.co/1hSMZ4X2pt

[221BlueStreet @SaharShukrun]

@pry0cc Those who judge you by your age and "years" of experience are ones you shouldn't pay attention to, don't spend time proving them wrong.

I Also have no Academic education yet I lecture in a well respected University, about DFIR & more..

Show value, and people will respect you.

[LimaCharlie @limacharlieio]

We probably had a little too much fun making our new marketing video but we love the end result. Get the full picture of everything that the LimaCharlie Security Infrastructure as a Service can do.

Watch the video here: https://t.co/Ddt9LqSG5r

#infosec #mssp #cybersecurity #edr

[221BlueStreet @SaharShukrun]

Meet OSSEM, another great project by @Cyb3rWard0g , the project's goal is to maintain and standardize a Common Information Model for different events data sets.
It also aims at having a data dictionaries for each data set source (Sysmon, WinEvt, EDR's)
https://t.co/0rLZkGZ2yG

[221BlueStreet @SaharShukrun]

A rough overview of how EDR products works and couple of notes about EDR weaknesses that are common in multiple EDR vendors.

Nice read
https://t.co/GKJq9i4ani

[Florian Roth ⚡️ @cyb3rops]

Sharing one of my obfuscation detection #YARA rules with the community

PowerShell Caret Obfuscation

> note the fixed 3byte atoms at the beginning & end of $s1 & $s2
> necessary to improve regex performance

Rule
https://t.co/6AxY8xnin2

Retrohunt + Munin
https://t.co/ibuFWj2auH