Abdulrahman Alsuhaimi

خبير أمن معلومات Cybersecurity Specialist

[MalwareHunterTeam @malwrhunterteam]

😂

[Abdulrahman Alsuhaimi @aasuh88]

lol

[Timo Steffens @Timo_Steffens]

A surprising thing in the APT31 indictment is that there is no dedicated infrastructure subteam. Instead, the suspects seem like multi-taskers. Surprising,since their infrastructure looks quite consistent. Maybe a documented team playbook or tooling for setting up infrastructure?

[Abdulrahman Alsuhaimi @aasuh88]

Short Term Solution: Block & monitor calls to ChatGPT

Medium to Long Term Solution: Zero-trust internet access

[Florian Roth ⚡️ @cyb3rops]

Oh, boi
https://t.co/6X8bxsNEdd

[Abdulrahman Alsuhaimi @aasuh88]

@cyb3rops Short Term Solution: Block & monitor calls to ChatGPT

Medium to Long Term Solution: Zero-trust internet access

[Abdulrahman Alsuhaimi @aasuh88]

@AbuReem84 ذكريات يوم كنت بسادس وشايل هم الوالي

[Abdulrahman Alsuhaimi @aasuh88]

@HemayaGroup @BIACsaudi أتقدم بالشكر لكم على هذه الفرصة الطيبة وتقديم الفرصة لنا لمشاركة القليل من المعرفة، وهذا أقل جهد نستطيع تقديمه للمساهمة في جهودكم المميزة

[Abdulrahman Alsuhaimi @aasuh88]

@SaifAlHarthi People on the internet generally talk less about proprietary products.

[Abdulrahman Alsuhaimi @aasuh88]

@hylian_pirate @azizhud It’s better than Majora’s Mask

[Abdulrahman Alsuhaimi @aasuh88]

@YodaZh يقول انترنت داونلود منجر 🤣🤣🤣 غير موضوع ان الفلاش طفى خلاص

[Abdulrahman Alsuhaimi @aasuh88]

@asfakian Great presentation BTW!

[Abdulrahman Alsuhaimi @aasuh88]

@asfakian

[Abdulrahman Alsuhaimi @aasuh88]

@Xbox_Saudi واحدة من أفضل الألعاب اللي لعبتها في العشر السنوات الماضية

[Abdulrahman Alsuhaimi @aasuh88]

@SakharAlkhereyf الف مبروك يا صخر وتستاهل منها للافضل ان شاء الله

[Abdulrahman Alsuhaimi @aasuh88]

This is why you should always control outgoing web access. Only allow servers internet access on a per-case basis with a whitelist of allowed domains. There are a lot of ways to reduce the risk of outbound HTTPS beaconing/C&C.

[Abdulrahman Alsuhaimi @aasuh88]

Groups identified by different threat Intelligence providers are not necessarily the same.

[Katie Nickels @likethecoins]

I'm generally a pretty positive person, but it's Festivus, so let's blow off some steam and air our #threatintel grievances. Threat intel feeds are just data feeds, they're not threat intel. Please stop naming groups after malware, it's confusing AF.

[SANS Institute @SANSInstitute]

#ICYMI: You can view the recording of yesterday's SANS Emergency Webcast regarding the #Solarwinds incident led by @MalwareJake here:

https://t.co/oHTPET6Cvo

#solarigate

[Abdulrahman Alsuhaimi @aasuh88]

Your CTI program should always include information on IT Supply Chain attacks, even if you do not have any software/services targeted. The goal is to expand possible detection measures and architecture modifications, based on understanding supply chain attacks TTPs.

[Abdulrahman Alsuhaimi @aasuh88]

This is why you should always control outgoing web access. Only allow servers internet access on a per-case basis with a whitelist of allowed domains. There are a lot of ways to reduce the risk of outbound HTTPS beaconing/C&C.

[Sara Schleisman @SaraSchleisman]

#SolarWinds #SolarWindsOrion webcast with @MalwareJake. If you missed the talk a link to the recording will be available soon #ThreatIntel

[Abdulrahman Alsuhaimi @aasuh88]

DDoS? DNS? A change gone wrong?

https://t.co/PFsPjcDmSA

[Abdulrahman Alsuhaimi @aasuh88]

Important and fantastic thread

[Nick Carr @ItsReallyNick]

So you want to talk about the massive software supply chain intrusion & the most carefully-planned, complex espionage I’ve ever helped uncover?

Start here: https://t.co/m1nJG5UlVk 🤩

But then what?? Let’s talk about some post-compromise techniques...