C M UPPIN

Cyber Security | Threat Hunter

[C M UPPIN @cmuppin97]

@NinjaParanoid Also the SOC companies make it more hype.

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Thank you for mentioning #TextShell, I really love your blogs @sekoia_io :3 very well-structured and nicely formatted.

[Nasreddine Bencherchali @nas_bench]

[New Blog📚] A Shared Arsenal: Identifying Common TTPs Across RATs

Check out this latest Splunk blog by @tccontre18 and I, where we've looked at multiple RAT families based on open intel and our past research, to identify common TTPs.

https://t.co/64OQXBq8YZ

[flux @0xfluxsec]

If you are interested in Red Teaming, Offensive Engineering, Defensive Engineering, and/or Windows Internals, here is my list of people who are worth knowing the work of / following who produce sick blogs / github projects / community teaching:

@5mukx
@jamieantisocial
@xacone_
@Octoberfest73
@0xTriboulet
@33y0re
@vxunderground
@_RastaMouse
@eversinc33
@Steph3nSims
@Flangvik
@cyb3rops
@sixtyvividtails
@JonnyJohnson_
@LeighGi66657535
@C5pider
@NinjaParanoid

[C M UPPIN @cmuppin97]

@Nishan_011 Agebt

[C M UPPIN @cmuppin97]

@airindia
Thank you for helping in providing the smooth check-in and arranging seat was really helpful Roni & abhirami.

[Karsten Hahn @struppigel]

These PDF editors are functional but each contain a backdoor

➡️https://t.co/MCglS8yOkm

#TamperedChef

[_ark_ (@[email protected]) @is_henderson]

#Oyster Loader #MalwareAnalysis is out. Please let me know what you think, if it's helpful, and what needs to be improved on for the next one. Thanks to my colleagues for help on this and the heavy lifting. I learned a lot doing this.
https://t.co/EeHwb2k33N

[Mololuwa | Cybersecurity - (The God Complex) @cyber_rekk]

🚨 How I Traced a Malware Infection in Network Traffic from DNS Query to Data Exfiltration using Wireshark

Incident report summary available below 👇

A thread (🧵)

Before anyone noticed, an infected machine checked its public IP, established a connection with a remote server, and began exfiltrating data. But how did it happen?

Here’s how I uncovered the attack—step by step. 🧵👇

[Florian Hansemann @CyberWarship]

''MalDoc in PDF - Detection bypass by embedding a malicious Word file into a PDF file – - JPCERT/CC Eyes''

#infosec #pentest #redteam #blueteam
https://t.co/QIWN2S35OS

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Talking to a friend now I remembered something. Back in 2018, when I started learning about windows internals, me and my friends started this strict habit to take 10 exe/DLLs from System32 directory and just google/read up about them. No fancy hacks, no reversing, nothing. We did this for around 60 days and amount of knowledge just by googling was insane. You dont need books, or courses to learn anything (although I sell a few). Its all about giving a dedicated time to a few things and following it up with discipline. People think about advanced things and get scared. But its always more about how good your fundamentals are. If you have a good understanding of basic fundamentals, everything else becomes much easier to learn.

[Luke Stephens (hakluke) @hakluke]

It has been assigned CVE-2024-30078.

More info here: https://t.co/hsPIquoaFs

[vx-underground @vxunderground]

A sitcom that follows a group of friends, the up's and down's in the Russian ransomware cyber crime ecosystem, and their ultimate pursuit of love

[Dark Web Informer @DarkWebInformer]

One of the best Cybersecurity memes I've ever watched. 🤣

[spencer @techspence]

I'm gonna start calling this THE FABULOUS FOUR! 😂

[DirectoryRanger @DirectoryRanger]

Active Directory Advanced Threat Hunting - Compare GPOs with the Security Compliance Toolkit #DFIR
https://t.co/DfEh1xr91h

[Nicolas Krassas @Dinosn]

PingRAT: secretly passes C2 traffic through firewalls using ICMP payloads https://t.co/Yr260cyAr6

[C M UPPIN @cmuppin97]

@NinjaParanoid Congratulation 👏👏 and all the best 🥳,

Your story inspired and learned a lot

Thank You 🙏.

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Took a 2 week break from everything. Finally back. Time for an update to my older blog... "Evading every EDR on the Planet part 2..." SorryNotSorry defenders 🤓

[vx-underground @vxunderground]

Alternatives to 'whoami.exe'.

COM interface ideas:
- IADsADSystemInfo
- IADsWinNTSystemInfo
- IADsComputer
- WMI COM provider to query 'whoami.exe'

IADsADSystemInfo, IADsWinNTSystemInfo, and IADsComputer are all fundamentally similar in calling syntax and are pretty copy-pasta ish. Windows SDK is kind of a pain though, the GUIDs weren't located easily, so they needed to be manually defined.
Example: https://t.co/b9CJZzkybK

Advapi32 functionality:
- Advapi32!LookupAccountSidW
- Advapi32!LsaLookupSids

LookupAccountSidW is an internal wrapper that calls LsaOpenPolicy, LsaLookupSids, and subsequently LsaFreeMemory. LsaFreeMemory is a wrapper to RtlFreeHeap.
Example: https://t.co/1vFBV9Ib3Y

Other possibilities:

- NpGetUserName - gets the username from a named pipe. Requires spawning a secondary thread, creating a named pipe, connecting to it, impersonating it, ... it is a long story =D

- Offlinesame.dll - Offline sam has a lot of functionality for enumerating users and domains on the machine. This is undocumented and requires a little more work. However, it has been demonstrated loosely by @0gtweet
Example: https://t.co/DbdFNwFBri

tl;dr can't stop thinking about whoami.exe :(