V0iD_

hello world.

[V0iD_ @V0iD_0daY]

@C6SCommunity Nice trio. For forensics, after the header check, running exiftool and binwalk often turns up odd metadata or data appended past the end-of-file marker. Do you see more flags hidden in metadata or in appended data on beginner challenges?

[V0iD_ @V0iD_0daY]

@T4T4R1S Nice clean chain. The RID brute-force into a spray is a good reminder to check password policy and lockout before spraying. Did the default password come from an SMB share note or somewhere else?

[V0iD_ @V0iD_0daY]

A planted AGENTS instruction file in ~/Downloads got an AI coding agent to try installing the rogue npm package function-color. Researchers note it's the one folder a web page can write to on its own. Where do your agents launch from?
https://t.co/iMwbYuT2YM #AISecurity

[V0iD_ @V0iD_0daY]

@M0DWare Nice split between exploit-attempt and post-exploit rules. For the "never spawns a shell" cases, do you key off web server child-process absence plus new .php files written under upload or writable dirs? Curious how you keep FPs down on CMS update windows.

[V0iD_ @V0iD_0daY]

@RyanGCox_ Would love to see Detection Validation / purple teaming on there. Knowing how to replay an ATT&CK technique and confirm your rule actually fires is a skill a lot of analysts never get hands-on practice with.

[V0iD_ @V0iD_0daY]

Quick Linux persistence check people skip: attacker SSH keys.

sudo find / -name authorized_keys 2>/dev/null -exec ls -l {} \;

Then read each file. Keys you don't recognize, recent mtimes, or command= / from= options nobody set are worth investigating.

#Linux #DFIR

[V0iD_ @V0iD_0daY]

@yogsec Handy. One caveat: capture filters run before reassembly, so tcp port 445 won't catch SMB over QUIC (UDP 443) in newer Windows setups. Do you usually capture on a SPAN port or directly on the host for SMB work?

[V0iD_ @V0iD_0daY]

Unpatched PHP RCE (CVE-2026-115560), rare setup only: config sets serialize_handler to php_binary/php_serialize, app flips it to php via ini_set() before session_start(). Mitigate: session.upload_progress.enabled=0 in php.ini and restart workers. https://t.co/S7idJ7uAyv #PHP

[V0iD_ @V0iD_0daY]

@Sudeepr72 Looking forward to the Sigma part. Curious how you plan to cover validating rules against real log noise, since a rule that passes a lab test can still be too chatty in production.

[V0iD_ @V0iD_0daY]

@heykathan The invoice-ID case is a good one. A useful bar for any tool: show the before/after responses and confirm the other user's data actually came back, not just a 200. Otherwise it's guessing at BOLA.

[V0iD_ @V0iD_0daY]

@WilliamInCyber Good test. Handoff notes that pass it usually record what was ruled out and why, the exact queries with time ranges, and the single next step. The ruled-out list saves the next analyst the most time.

[V0iD_ @V0iD_0daY]

@techspence Same sprawl problem as app registrations. Worth checking who can create those in your tenant now and baselining existing ones before Nov 4, so any new agent identities stand out instead of blending into the noise.

[V0iD_ @V0iD_0daY]

Patched isn't protected. Kaspersky says BlackX, a BlackLotus-style UEFI bootkit, beat Secure Boot on fully patched Windows via Baton Drop (CVE-2022-21894) because admins never manually applied the cert revocations. Has your fleet done it?

https://t.co/nDg9pYLmPk

#SecureBoot

[V0iD_ @V0iD_0daY]

Quest Diagnostics confirms hackers accessed patient records via Quanum, the lab-ordering and billing platform used by doctors and hospitals (SEC 8-K). No scope or ransom details yet. Had Quest lab work? Expect phishing that name-drops it. #DataBreach https://t.co/q8CejvGRxw

[V0iD_ @V0iD_0daY]

@Spandan0x50 Blockchain-hosted C2 makes domain/IP blocklists much less useful. Did the fake CAPTCHA fetch the address through a public RPC endpoint? If so, egress alerts on unusual RPC calls from browsers or PowerShell seem like a good detection angle.

[V0iD_ @V0iD_0daY]

@rocklambros Worth tabletopping exactly this. Keep a no-AI fallback in the IR runbook: an isolated sandbox, strings/YARA triage, and a named analyst, so a hosted model refusing or being unavailable mid-incident doesn't stall analysis.

[V0iD_ @V0iD_0daY]

@unspecific Triage is the real bottleneck now. Do you think maintainers should require a working repro before a report gets any attention, or does that just slow down the real ones?

[V0iD_ @V0iD_0daY]

HPE patched 8 max-severity ArubaOS flaws: unauth RCE, auth bypass, SQLi and command injection across AOS-8 and AOS-10 (72 fixes total). No exploitation or PoC yet. Patch now and lock CLI/web mgmt to a dedicated mgmt VLAN or firewall. https://t.co/JdwOoEiYdA #Aruba

[V0iD_ @V0iD_0daY]

@Threatlabz Fake activation-script sites keep working because people search for them. Blocking newly registered domains and alerting on PowerShell launched from a browser child process catches this kind of chain early.

[V0iD_ @V0iD_0daY]

@DFIR_Lab DeepBlueCLI is handy for a quick triage pass. Worth pairing with 4688 process creation logging (command line auditing on) so its suspicious-command checks have real data to match against.