paritosh

CISSP | CIRT

[paritosh @bhttparitosh]

AI coding assistants like GitHub Copilot, Codeium, and Cursor are now part of everyday dev workflows inside Visual Studio Code.

But what artifacts do they leave behind on a system?

#DFIR #CyberSecurity #DigitalForensics #VSCode #AI

[paritosh @bhttparitosh]

How Threat Actors Abuse Cloud Services for Phishing Infrastructure
https://t.co/8tTHoYPkOW

[paritosh @bhttparitosh]

Common IOC Hunting Mistakes New Analysts Make (And How to Avoid Them)
https://t.co/HwZBiWYgnQ

[paritosh @bhttparitosh]

10 Free OSINT Tools I Use Almost Every Day
https://t.co/WsUmgfNPqX

[paritosh @bhttparitosh]

Hmmm a good one to join…

[TrustedSec @TrustedSec]

Last chance to join today's webinar at 1:00PM! Get a clear picture of where your IR program stands and what it actually takes to keep up with the speed of modern attacks. Register now! https://t.co/k209R8yA28

[paritosh @bhttparitosh]

OSINT Techniques I Use Almost Daily
https://t.co/T2f3Zhrmok

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[paritosh @bhttparitosh]

The word ‘internal’ doing a lot of heavy lifting here... If your ‘private’ repo contains plaintext secrets, today’s a good day to rotate them.

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[paritosh @bhttparitosh]

@sherrod_im Hmm seeems true !

[paritosh @bhttparitosh]

SharePoint and OneDrive as Exfil Channels
https://t.co/B1KztibDYu

[paritosh @bhttparitosh]

Fast Flux DNS & Bulletproof Hosting: The Infrastructure Behind Persistent Threats
https://t.co/g6477z60Wx

[paritosh @bhttparitosh]

Domain Fronting: Hiding C2 Behind CDNs
https://t.co/I9wHtkMcEx

[paritosh @bhttparitosh]

@kaaaash____ Charger leke nahi ghumna padega😅

[paritosh @bhttparitosh]

Dead Drop C2 Channels
https://t.co/lKH0Cdb9wx

[paritosh @bhttparitosh]

@asherrkiinee 0 likes

[paritosh @bhttparitosh]

Dark Web Monitoring for Threat Intelligence Analysts
https://t.co/zpma1HuYdH

[paritosh @bhttparitosh]

Initial Access Brokers (IABs): The Hidden Supply Chain of Modern Cybercrime
https://t.co/1ZRno59jVq

[Nicolas Krassas @Dinosn]

PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems https://t.co/IHHSxHBkUN

[paritosh @bhttparitosh]

Temporal freshness: Is this recycled data from a 2019 breach being re-listed as new? Cross-reference against Have I Been Pwned API and your known breach history.

[paritosh @bhttparitosh]

NEVER act on an unvalidated dark web alert.
Validate on three axes:

[paritosh @bhttparitosh]

Content authenticity: Do sample records actually match your organization’s format? Check email domain patterns, password policy patterns (length, complexity), internal naming conventions that wouldn’t be publicly known.