charley pfaff

incident handler, threat hunter, red teamer, forester, exploit researcher all views are my own

[charley pfaff @charleypfaff]

Morning Coffee and music had me thinking about the socgholish strings and converting on both platforms. Enjoy

[charley pfaff @charleypfaff]

For PS
$evil = “gmzoxce.mslrdepnjtcrsazpphqtvlhaseahhevvyiztpagrngyertlnqix.itjsyozhs.t5vbz0x7xdbfo2n4f”
$step1 = $evil.ToCharArray()
[array]::Reverse($step1)
$step2 = -join($step1)
-join @(for ($i = 1; $i -lt $step2.Length; $i += 2) {
$step2[$i]})

[charley pfaff @charleypfaff]

Many ways to do this one , string might look familiar.
echo "gmzoxce.mslrdepnjtcrsazpphqtvlhaseahhevvyiztpagrngyertlnqix.itjsyozhs.t5vbz0x7xdbfo2n4f/p/b:osfpatgtqhx" | rev | sed "s/.\(.\)/\1/g"
#socgholish

[charley pfaff @charleypfaff]

Regarding tools that are important, if you sandbox technology performs like old school drum and bass music where it takes over 1.5 minutes to get to the point of opening a browser it might be time to think about a change.

[charley pfaff @charleypfaff]

I was curious about some of the recent socgholish infections and a few articles that stated that the usual move is Cobalt Strike within 10 minutes. From what I have researched it has been IcedID at the moment.

[charley pfaff @charleypfaff]

When building out your cloud based lab environment with openconnect. using the --script and vpn-slice can be exactly what you are looking for when trying to maintain other services on the system you are connecting from.

[charley pfaff @charleypfaff]

Glad I could resupply with my favorite hot sauce yesterday. Buffy overflow - obviously garlic and ghost in the /bin/sh - ghost pepper

[charley pfaff @charleypfaff]

Some days just a simple head shake meme will suffice.

[charley pfaff @charleypfaff]

Wife is a developer and on a call and mentioned she changed the current row variable to "cur_row_nu" for current row number.... I laughed because she said it strait faced but I guess not many on that call got it.

#code_humor #levity

[charley pfaff @charleypfaff]

Another back to basics hunting is leveraging pages like https://t.co/XWktJ93jwD be warned it is fairly large. Nice to see output of the DGA's for the current day. Hunt once detect after.
#DFIR #hunting #Detect

[charley pfaff @charleypfaff]

If you want to get started hunting sometimes getting back to basic basics and use all the registered sinkholes, you might be surprised if your org hasn't already operationalized one already. Found this list to get started. https://t.co/gmKtz65tpK
#DFIR #hunting

[charley pfaff @charleypfaff]

After loosing my chest freezer in March I built remote monitoring solution using some 8266's, dht22's, IFTTT, and deep sleep. Now I get emails with temp of the freezers if above 0 in the house running off of small phone chargers. #arduino #monitoring

[charley pfaff @charleypfaff]

I wonder how many people still leverage VT top contributors when hunting for new IOC's and new samples. https://t.co/lI2jUb2Xf3
#iochunting

[charley pfaff @charleypfaff]

Latest responder in the household, was going to call her pop-pop-ret but she doesn't return well. #cyberpuppy

[charley pfaff @charleypfaff]

@Trex421 👍thanks JT

[charley pfaff @charleypfaff]

@Trex421 Awesome stuff thanks

[Suricata IDS/IPS @Suricata_IDS]

Announcing release of #Suricata 5.0.0

Protocol additions, rule lang cleanup, eBPF/XDP, (experimental) datasets, JA3S and more:

Announcement: https://t.co/zNT5pK3UxZ

Release notes: https://t.co/StZESZqbES

Download: https://t.co/NnExMNIR5i

#opensource #infosec #ids #ips #nsm

[charley pfaff @charleypfaff]

@Trex421 @bammv @JosephFeather @TimothyHeilman4 It's been an awesome ride from bringing down bad to finding skeleton keys. Thank you for being a part of our team . Like @bammv said, sad to see you go but excited at the same time for you. Adding to 'screen' comment, only if uptime is over 3000 days ;) #uptime4life

[charley pfaff @charleypfaff]

@Trex421 @JosephFeather Lol, this is great should end with.... and does what it's intended to do. Great stuff.

[charley pfaff @charleypfaff]

@jbc22 @DavidJBianco @Mephux Lol, you and me both