Andrew Munchbach

@[email protected] — Engineer. Cheez-It connoisseur. Fragment abuser. Forever in search of the perfect backpack.

[Andrew Munchbach @amunchbach]

@patrickwardle Wait till you see what they've done with non TCP/UPD traffic in 15.3 ⚰️

[Andrew Munchbach @amunchbach]

@rad9800 @clownstrike_og @CrowdStrike Yes. The number of legitimate programs that modify this key and value is terrifying :)

[Andrew Munchbach @amunchbach]

@rad9800 @clownstrike_og @CrowdStrike Awesome. Thank you for sharing :)

[Andrew Munchbach @amunchbach]

@rad9800 @clownstrike_og @CrowdStrike Let me have a look at this one. I was having a hard time following the thread, but I think I have it sorted now.

[Andrew Munchbach @amunchbach]

I have no idea why @Apple and @Google don't build a setting into iOS and Android so you can set your phone to reboot daily/weekly/monthly on a schedule. I'd reboot daily 🤷
https://t.co/HqBdJDwjE9

[Andrew Munchbach @amunchbach]

@GolfweekNichols They seemed to blame… the volunteers? For thousands of people being in line and unable to get on shuttles? We left after being given a 3-4 hour estimate at 6:50a. Might just fly home. What a calamity.

[Andrew Munchbach @amunchbach]

@molecularmusing @CrowdStrike Hi there. FWIW, this is off by default. Customers have to manually enable it in their prevention policy. It can, obviously, be toggled off again if it's an issue.

[Andrew Munchbach @amunchbach]

@originalvillen @LitMoose I wish I had Eddie's mustache, but I do not pait @LitMoose 🤣

[Andrew Munchbach @amunchbach]

@BruceDawson0xB @statictear @CrowdStrike Thank you. Will pass to ENG. In the meantime, if this is causing a PROD issue, disabling "Additional User Mode Data" in the Falcon prevention policy will prevent that DLL from being loaded into Chrome after Chrome is restarted.

[Andrew Munchbach @amunchbach]

@statictear @BruceDawson0xB @CrowdStrike Is there a Support case I can reference? Would need some details.

[Andrew Munchbach @amunchbach]

Want to hunt the most dangerous game? I'll be teaching an advanced threat hunting course at @CrowdStrike #FalCon2023 this September. Come learn with us!

[Andrew Munchbach @amunchbach]

Great article from @CrowdStrike Services Team on how to identify data exfiltration on exploited MoveIt servers via log file forensics: https://t.co/h8W3sqk0O0

[Andrew Munchbach @amunchbach]

@AppSecBloke @CrowdStrike Hi Mike. That's not cool. Can you please DM me the full email address of the sender and I'll address this internally? I work for CrowdStrike. Following you now.

[Andrew Munchbach @amunchbach]

@mthcht All good. Went down the same rabbit hole. Just figured I would ask :)

[Andrew Munchbach @amunchbach]

@mthcht Question on this: 🔍 Sysmon EID 3 / EDR network telemetry: image outlook.exe & dest port 445

Are you seeingS SMB TCP/445 traffic being pinned to outlook.exe's PID and not PID 4 (root)?

[Andrew Munchbach @amunchbach]

@DanielStepanic @CrowdStrike Great work by you and your team as well :) Team lift

[Andrew Munchbach @amunchbach]

@juanandres_gs @NickGalea3cx This is you yesterday asking Twitter for IOCs when a user reported a potential issue. I link you to a post with IOCs. A blog shows up 9 hours later. Saying you've been working on this for a week without any sort of responsible disclosure is either: (1) despicable (2) insane.

[Patrick Wardle @patrickwardle]

RE: The 3CX VOIP supply chain attack, vendors have stated that macOS was also targeted - but I couldn't find any specific technical details (yet) 🍎🐛☠️

One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"

...let's dive in! 1/n 🧵

[Andrew Munchbach @amunchbach]

Once active, the HTTPS beacon structure and encryption key match those observed by CrowdStrike in a March 7, 2023 campaign attributed with high confidence to DPRK-nexus threat actor LABYRINTH CHOLLIMA... https://t.co/doqOBxXIjV

[Andrew Munchbach @amunchbach]

@Datamin49ers Yup. Seeing the same thing: https://t.co/doqOBxXIjV