Cryptsus

We craft cyber security solutions.

[Cryptsus @cryptsus]

New Sentinel SOAR blog post 🦎🔥 Use AbuseIPDB for Incident enrichment and more
https://t.co/9eCPu63Geq

[Panos Gkatziroulis 🦄 @ipurple]

A BloodHound collector for Microsoft Configuration Manager https://t.co/SOGgP2OEGE #redteam

[Eliran Nissan @eliran_nissan]

I am excited to share with you my latest research - "DCOM Upload & Execute"
An advanced lateral movement technique to upload and execute custom payloads on remote targets
Forget about PSEXEC and dive in!
https://t.co/ruQJlXgLqV
https://t.co/Yp25P6pZvH

[BleepingComputer @BleepinComputer]

Phishing emails increasingly use SVG attachments to evade detection - @LawrenceAbrams
https://t.co/HLRNCqLBqr

https://t.co/HLRNCqLBqr

[Cryptsus @cryptsus]

📣New blog post: 🔥4 New Analytics Rules for Palo Alto in Azure Sentinel SIEM🚀 https://t.co/AGriR8lCi2 #NGFW #AzureSentinel #PaloAlto

[BleepingComputer @BleepinComputer]

Google is enabling its real-time Enhanced Safe Browsing feature for all Chrome users over the coming weeks.

We are told it will not be possible to select the legacy Safe Browsing version once this rolls out.
https://t.co/Pew6YjWYT5

[Microsoft Threat Intelligence @MsftSecIntel]

We’re releasing a second version of our threat matrix for storage services, a structured tool that can help identify and analyze potential security threats on data stored in cloud storage services. Learn about the new attack techniques in the matrix: https://t.co/QOu3HZKRM5

[Justin Elze @HackingLZ]

Hands on activity on the rise? Does this indicate a decline of AI attacks? https://t.co/8EG9wXYpkH

[BleepingComputer @BleepinComputer]

KeePass v2.54 fixes bug that leaked cleartext master password - @billtoulas
https://t.co/5GHR731TRK

[Cryptsus @cryptsus]

Check out our latest blog post to learn more on how to monitor your EKS or AKS #container workloads for malicious activity with #falco and #sentinel #SIEM https://t.co/WOuInIj7fT

[John Lambert @JohnLaTwC]

Interested in a DevOps attack matrix?
➡️https://t.co/Qib5VFGGDH

[BleepingComputer @BleepinComputer]

WinRAR SFX archives can run PoweShell without being detected - @billtoulas
https://t.co/oMkXMgvYWJ

[Cryptsus @cryptsus]

Nice to see our blog post has been adopted by the FIDO Alliance for Enterprise Authentication: https://t.co/BAfJ8qo6JR

[OSAKANA TARO @osakanataro2]

Supply Chain Backdoor Attack in CCTV IP-Cameras
https://t.co/or8mDwlgrN
IngeniC T20系WebCAMのfirmwareにバックドア仕掛けたあと返品する、というある意味恐ろしい話が^^;;

[Cryptsus @cryptsus]

See our latest detection rule on how to leverage Zscaler to detect phishing attacks with Sentinel SIEM
https://t.co/2KYVfYz1IB

[Cryptsus @cryptsus]

Enrich your Sentinel SIEM log data with GeoIP lookups to get more visibility in your authentications and sessions: https://t.co/rn944df2vr

[Alex Teixeira @ateixei]

Got CyberChef in Splunk? Here's the magic parameter for decoding PowerShell: jsonRecipe="[{"op":"From Base64","args":["A-Za-z0-9+/=",true,false]},{"op":"Decode text","args":["UTF-16LE (1200)"]}]" #SPLNuggets #ThreatHunting #DetectionEngineering

[TrendAI™ Research @trendai_RSRCH]

NEW BLOG ENTRY: A recent case involving the #QAKBOT ‘BB’ distributor led to the deployment of Brute Ratel (detected by Trend Micro as Backdoor.Win64.BRUTEL) — a framework similar to #Cobalt Strike — as a second-stage payload.

Stay informed and read more: https://t.co/Rz9sQdf39w

[Nathan McNulty @NathanMcNulty]

Oh hell yeah, this is cool!

DeviceNetworkEvents
| where RemoteIPType == "Public"
| where InitiatingProcessVersionInfoOriginalFileName in ((
externaldata ( Name:string ) [ "https://t.co/m8rJbl7KnU" ]
with (format=csv, ignoreFirstRecord=true) | distinct Name
))

#MDE

[Cryptsus @cryptsus]

@DThompsonDev @kylekyle Companies claim to be secure once MFA is configured on all accounts. However, this Uber hack proves cloud-based MFA push notifications can be abused. This blog post explains how to detect this attack when you use Azure AD + Sentinel https://t.co/U0qqpdfvts