Qazeer

[Qazeer @_Qazeer]

Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: https://t.co/sKK1QPqOlx 1/2

[Renzon @r3nzsec]

I recently co-authored a @Unit42_Intel blog about a unique IR case in which a threat actor’s custom EDR bypass (using #BYOVD) exposed their toolkit, methods, and even identity. Check out how we unmasked them through an opsec slip-up! #dfir

https://t.co/TRvedMDQUL

[Invictus Incident Response @InvictusIR]

What a glorious day for Incident Responders around the world! Premium audit events in Microsoft 365 are now available to non-premium users.

🚨Action for you:
- Check your mailbox audit settings, details in the blog:
https://t.co/mEkdtozsaO

[Qazeer @_Qazeer]

@lkarlslund Among the things that can be checked by FarsightAD (https://t.co/5zrng9skWr) in a post forest / domain scenario :)

[Maxime Meignan @th3m4ks]

How to disable some parts of EDR’s telemetry on Windows 10? Just ask nicely!
See https://t.co/Vxio1trFh4 for more info about an interesting logic bug we found on Win10 that affects all EDRs 😉

[Gabriel Landau @GabrielLandau]

Forget vulnerable drivers - Admin is all you need

Article 👉 https://t.co/dHO0KJ90WH
👇 Demo - enable sound 🔊

[Jean Marsault @iansus]

🚩 @wavestoneFR CTF team #YoloSw4g ranks first of 80+ teams at #CyberEx23!

🚩 Thanks @INCIBE and @OEA_Cyber for the organization & challenges!

🚩 Congratz to @_Qazeer @th3m4ks and @meaz0u for the great team we've been for the last 8 hours, now we go to a well-deserved sleep!

[NoLimitSecu @nolimitsecu]

#Podcast #Cybersécurité

Épisode #387 consacré à l'outil de contournement des EDR, "EDR Sandblast", avec @th3m4ks et @_Qazeer

https://t.co/Sq5k0h9LhS

[Maxime Meignan @th3m4ks]

A promise is a promise: the slides from the #DEFCON30 DemoLabs @_Qazeer and I presented about EDRSandblast are uploaded on GitHub (https://t.co/21tSHBe7Te), along with the latest version of the tool! Check out the list of new features in the slides, documentation is on its way ;)

[Qazeer @_Qazeer]

@Jipe_ Thank you for the shout-out @Jipe_!

[Qazeer @_Qazeer]

FarsightAD and the slides from the SANS DFIR Summit 2022 "Hunting for Active Directory persistence" talk can be found on GitHub as well: https://t.co/5zrng9skWr. Thank you to all the in-person and virtual attendees! 2/2

[Qazeer @_Qazeer]

Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: https://t.co/sKK1QPqOlx 1/2

[Jean Marsault @iansus]

Actually good question, let's start with obviously wrong answers and see where they lead us. A thread 🧵

[Will Schroeder @harmj0y]

Hey, do you like tokens? Have you always wanted to "harvest" tokens for offensive purposes? If so check out my new post https://t.co/5Tr9UxYuh1 where I show I can (finally) write a technical post without memes, and then check out the Koh toolset at https://t.co/l77vlPDQrj

[Arnaud SOULLIÉ @arnaudsoullie]

I'm extremely proud to announce @wavestone_ speaking engagements at @BSidesLV @defcon & more, and it doesn't fit in a tweet (far from it, actually), so a 🧵:

[Alice Climent @AliceCliment]

You enjoyed the awesome EDRSandblast tool of @th3m4ks and @_Qazeer and want to know more about the vulnerability used in the MSI AfterBurner driver to play in the kernel mode ?

Go check the vulnerability analysis done by hfiref0x

https://t.co/zEOmrwXoWE

[mpgn @mpgn_x64]

🇫🇷🎙️ Nouvel épisode du podcast @hacknspeak avec @th3m4ks & @_Qazeer pour parler de leur outil EDRSandBlast 🚀

Une interview un peu plus technique que d'habitude où l'on parle du fonctionnement d'un EDR et des mécanismes de contournement 🔥

Bonne écoute 🎶https://t.co/Uk6FuIJ6oC