b00010111

#DFIR #ICS #BlueTeam
Author of smbtimeline: representing my employer (past & present). Mastodon: @[email protected]

[b00010111 @b00010111]

@shirley74232 @HelpZach_ @977qmm @Kjw3434 hm? any context on this?

[b00010111 @b00010111]

Pushed a small bug fix for smbtimeline. It crashed due to wrong handling of smb2.ioctl.function: https://t.co/YkuX9T8iO7 #DFIR #Blueteam #SMB

[b00010111 @b00010111]

So actually twitter has decided to lockout the app I used on my mobile to read my timeline and send tweets. Guess I need to find the time to see who else is on #mastodon and follow there. Not sure what to do with the delta... Guess I will become more quite on twitter now...

[Jorge Orchilles @jorgeorchilles]

A new method of detecting PsExec with the release of v2.3 in 2021 is through a .key file. Blogged by Fabian Mendoza https://t.co/eexUmgIBMq

[Chad Tilbury @chadtilbury]

Interesting tool to facilitate WinAPI function calls via command line parameters:
https://t.co/ziQpvqBFmd

[b00010111 @b00010111]

@ScottQuennevil1 @DrunkBinary context: On a telegram channel used by the group GhostSec, they claim to have successfully attacked and encrypted an RTU. If I remember correct, they claim of have done this to RTUs in Belarus.

[b00010111 @b00010111]

Detecting Fake Events in Azure Sign-in Logs:  https://t.co/0xfVdNgKRE #DFIR #Azure

[b00010111 @b00010111]

Deep Dive Into poweRAT - Stealer/RAT Combo Polluting PyPI : https://t.co/tix2RdJvsF

[b00010111 @b00010111]

https://t.co/WJwbH8s2Lg :: https://t.co/1MsRAnkP3u - A database of file extensions being used by attackers

[Devon @aboutdfir]

New Windows 11 Pro (22H2) Evidence of Execution Artifact! now live at https://t.co/EmWFFlj2wh including By: Andrew Rathbun and Lucas G

[b00010111 @b00010111]

@jfslowik you can point them to https://t.co/tRlXTOb4Ek . We have some open positions to fill. Geolocation might be an issue, not sure we're your people are located.

[Maxim Suhanov @errno_fail]

Let's review a recent article about exFAT file system timestamps...

https://t.co/TaK4ghqRXZ #DFIR

[b00010111 @b00010111]

@mathias_fuchs Welcome mate!

[inversecos @inversecos]

1\ #DFIR: Detecting malicious device code phishing in M365 😈

This technique is HARDER to detect than OAuth abuse:
> No app registration needed
> Bypasses all MFA (token auth)
> No URL redirect

Not much has been written about detection so ..😝👇
https://t.co/1jIRBal0Gk

[b00010111 @b00010111]

Today I learned that CyberChef has been integrated into Arkime. How cool is that!

[SANS DFIR @sansforensics]

📺 SANS #DFIRSummit Talks are live! ️

🗣Featured Expert: Korstiaan Stam
👏 Presentation: Detecting Malicious Actors in Google Workspace

➡️ Watch Now: https://t.co/RKErGoe37W

[b00010111 @b00010111]

Pushed an update for gMetaDataParse, fixing an embarrassing copy&paste bug causing wrong data shown by the GUI in 'Found in cache dir' column for deleted items. Thanks to @chadtilbury for pointing it out. #DFIR https://t.co/iILddaC5OJ

[Francisco Falcon @fdfalcon]

Proof of concept couldn't be easier (you may want to do # echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all first to stop your OS from sending legit ICMP responses)

[b00010111 @b00010111]

RT @vxunderground: November 29th The FreeBSD Project reported ... a stack overflow ... in ping ...

More information: https://t.co/HZHvDCfEoA
> So it is: Don't ping my IP or I'll stack overflow you...funny times

[b00010111 @b00010111]

New #Hacking Humble Bundle! Up to 18 ebooks from No Starch with some titles that should not be missing in your #DFIR bookshelf.
https://t.co/5QQGFmjDi5