Ar4h

soc / cti analyst
|
fun memes & technical stuff 🫡

[The Brofessor @Glacius_]

Hey :)

If you missed your daily Frenglish dose, my talk about Octo at @virusbtn is now available on Youtube:
https://t.co/h6qRJ4QEYG

Talked about malware, infrastructure, bulletproof hoster, and more. The full paper is also available in the description :)

@teamcymru_S2

[Blanche @moustik01]

#DFIR folks, if you ever used #DFIRORC and got overwhelmed with the output, you'll be glad to know that thanks to orc2timeline, the new tool from @ANSSI_FR, you can now create a timeline directly from your collect! https://t.co/hfrmTQGSva

[tlansec @tlansec]

.@Volexity is looking for a new Threat Detection & Response analyst in the USA (remote) to join our growing team. Join us to work on some rather interesting cases 😃
https://t.co/anHPiSmAoe

[Clément Notin @cnotin]

@fabian_bader Damn! Persistence with secondary token-signing certificate is exactly what I anticipated and feared… https://t.co/dugP4BSYvQ

[DFIR-IRIS @dfir_iris]

🚀 DFIR IRIS v2.4.11 is here!
Now with MFA support, Notes revisions, improved alert relations, GraphQL on select endpoints, prebuilt docker images, and much more!

Warm thanks for all the contributions.

https://t.co/wdiENSin0X

[Ar4h @_Ar4h_]

@Brunomarx1985 @SpecterOps Hi thanks for the feedback, although I cannot share much details we can discuss un DM :)

[Ar4h @_Ar4h_]

Thrilled to release the second part of AD canaried blog post !
Hope some of you will enjoy reading it 😉
Once again cudos to @SpecterOps researchers and Airbus team !
Stay tuned for part 3 !
https://t.co/4GYx8CjKGc

#detectionengineering
#adcanaries

[topotam @topotam77]

https://t.co/2mwP0xWllF

[Andrea P @decoder_it]

"Hello: I'm your Domain Administrator and I want to authenticate against you". My #SilverPotato is out, check the blog post: https://t.co/3I9JjQ1QaK 😃

[Paul Rascagnères @r00tbsd]

You can read the details of our investigation concerning the CVE-2024-3400 on our blog post: https://t.co/SoAq4SyYue. It covers the backdoor (UPSTYLE) and also the post exploitation. #PaloAlto 1/4

[inversecos @inversecos]

APT Emulation Labs: NOW LIVE 🎉

Solve incidents emulating APT29, APT10 and other threat groups.

$45 per month access to ALL labs:
👀 150+ hours of lab content
👀 Disk forensics + ELK logs
👀 Hints, questions and point system
👀 7 days free trial

Labs are created & designed by industry peers:
@ZephrFish @svch0st @ippsec @DebugPrivilege @HuskyHacksMK @inversecos

Each lab comes
with scoping notes, Windows VM with forensic tools, network diagrams, disk forensics, ELK access and was created from our collective experience working in the field.

👇ACCESS THE LABS HERE 👇
https://t.co/raaUSztKtT

[Renzon @r3nzsec]

The usage of RMM, such as AnyDesk (ad_svc.trace) and FileZilla XML files, shows how valuable these artifacts are in revealing TA-related information such as IP and their further activities. Another good read from the gang @TheDFIRReport #dfir

https://t.co/5Uxr1Espva

[Kostas @Kostastsale]

Regarding the xz backdoored binary, see the one-liner below to check the version you have installed.

**I wouldn’t suggest folks running the malicious binary with -v option🫠🫣

for xz_p in $(type -a xz | awk '{print $NF}' | uniq); do strings "$xz_p" | grep "xz (XZ Utils)" || echo "No match found for $xz_p"; done

Some systems might have two different versions installed (i.e. if you have homebrew). The above command will check both. You can run the which command if you want to see which binary would run by default upon being called interactively. Good luck! 🙏

[Andrew Oliveau @AndrewOliveau]

👀👀🫵💥 "SeeSeeYouExec: Windows Session Hijacking via CcmExec"

New @Mandiant Red Team blog explores how SCCM's CcmExec service can be utilized for session hijacking and introduces a new tool, CcmPwn, to weaponize this technique! Defense tips included 🔵

https://t.co/JmV2i3Uw3h

[James Forshaw @tiraniddo]

This new book has finally arrived. Thank's to @nostarch as well as @billpollock for making it happen as well as @Lee_Holmes as my tech reviewer.

[tomchop @tomchop_]

Super excited about this opportunity 🤩

[DFIR-IRIS @dfir_iris]

🎉 IRIS v2.4.7 is now available and contains major changes compared to the last v2.3.7!

- 📝 New notes layout
- ⏱️ New timeline with child events and tree layout
- 📂 Bulk files upload in DS
- 👥 New access control
- Bug and security fixes

And much more! Check it out! 🤝

[Mayfly @M4yFly]

New lab 🏰 for the GOAD project 🥳: SCCM
You can now test the SCCM/MECM attacks locally on Virtualbox or Vmware.

More information here:
https://t.co/BvAZgLSHQr

Repository here : https://t.co/mi3rP9hC1H

Thx again @KenjiEndo15 for your help to building this !

[The Brofessor @Glacius_]

Hi o/

We released a blog on #Octo malware, exploring its capabilities, C2 communications, some infrastructure insights, hunting tips, bot stats, etc. Grab a coffee before reading:

https://t.co/V5YEnxn4L5

Feedback more than welcome 😊
(@teamcymru_S2)

[Will Schroeder @harmj0y]

I've had such an awesome experience working on Nemesis with @tifkin_ and @0xdab0 - we've been putting some hard work over the last two months and should have some cool things to share in the next few weeks! Stay tuned ;)

[spencer @techspence]

How every good defense oriented blog post ends😊😎