A.Türin

Head of @attackdetection team at @ptsecurity

[A.Türin @aksaxir]

Anniversary 100th tweet! 🎉 https://t.co/OeiulgMZHG

[Attack Detection @AttackDetection]

Catch #WannaMine #cryptocurrency malware chain (Over-Pass-the-Hash -> #WMI remote process creation) | #EternalBlue with this small and effective ruleset:
#Suricata rules and pcap: https://t.co/9GDnXHHlL7
Note: please, set $DC_SERVERS address group in Suricata config before usage.

[A.Türin @aksaxir]

Not a big deal — just Oracle's patch schedule leaves it as 0day https://t.co/2rQalTKZZM

[Attack Detection @AttackDetection]

#MySQL #MariaDB #PerconaDB root #RCE #0day
CVE-2016-6662
CWE-250
CAPEC-470
Affected: <= 5.7.15
#Suricata rules:https://t.co/oVHeH95XJB

[A.Türin @aksaxir]

Rediscover Suricata xbits https://t.co/Uh5BhXIdBJ

[Attack Detection @AttackDetection]

#FreePBX #RCE with #privesc
CVE:none
CWE-20
CAPEC-88
Affected: 13,14
#Suricata rules with xbits and pcap: https://t.co/YgIAKaVDsc

[A.Türin @aksaxir]

Searching for subdomains on a target system https://t.co/yfKRDMruDz

[A.Türin @aksaxir]

#Magento has a 30% share in the eCommerce market... and RCE also https://t.co/Ukc7FqagAg

[Attack Detection @AttackDetection]

New #Magento #ecommerce platform #RCE vulnerability
CVE-2016-4010
CWE-502
Affected: <2.0.6
#Suricata rule and pcap: https://t.co/mqX5HIoK47

[A.Türin @aksaxir]

#biohacking with @OpenBCI and tons of custom code at @phdays

[Attack Detection @AttackDetection]

New #PHP heap-based buffer overflow via zip
CVE-2016-3078
CWE-122
CAPEC-92
Affected: <7.0.6
#Suricata rule and pcap: https://t.co/wch7Bt7rQy

[A.Türin @aksaxir]

@securityaffairs yw Pierluigi!

[A.Türin @aksaxir]

@securityaffairs Here are technical details about this attack in @PTsecurity_UK blog post: https://t.co/om6I7AHZXt

[Attack Detection @AttackDetection]

A blog post about #squoison attack
https://t.co/0tCpExY4zi

[Attack Detection @AttackDetection]

New #Squid HTTP Cache Poisoning Attack detection rule
Affected: <3.5.18 <4.0.10
https://t.co/D3hSUmaqnv
CVE:none
CWE-345
CAPEC-141
#squoison

[Attack Detection @AttackDetection]

#Suricata #IDS rules for possible #DROWN Attack
CVE-2016-0800
CWE-200
CWE-310
https://t.co/9vAtgmjWMU

[Attack Detection @AttackDetection]

#Suricata #IDS rules for BIND CVE-2016-1285 #exploit #detection https://t.co/7615Xqjs1t
You can test by yourself with #pcap sample.

[A.Türin @aksaxir]

@jakx_ @subTee @tiraniddo @AlecRWaters @aionescu That's right Andrew https://t.co/DTtcD6bJpt

[Matt Nelson @enigma0x3]

RE @subtee's COM Scriptlet/Regsvr32 research..looking for ".sct" file extensions won't do much good:

[A.Türin @aksaxir]

Gh0st RAT is rather old but still being used in #APT https://t.co/HHLC3lgYU2

[A.Türin @aksaxir]

@Techhelplistcom @JustaguyAA Sorry guys, but osmanskayaargessia means "Оttoman empire agression" in Russian. More or less legit DN, not DGA

[A.Türin @aksaxir]

My college @Alexey_Lednev and I created #PoC of #FreeBSD Remote #DoS Exploit CVE-2016-1879 https://t.co/8KxAtP6idl

[A.Türin @aksaxir]

Further to yesterday @cyberpunkych talk at #ZeroNights https://t.co/kIiosWzpl3

[A.Türin @aksaxir]

Beware of SMS with links like hxxp://vkfoto[.]biz/id2432, foto2u[.]biz/id13123
https://t.co/VpHafHhms9
#android #malware #vkfoto #foto2u

[A.Türin @aksaxir]

#Comodo has reached a CA market share of 40%. I see, I see... #malwarelovescomodo