Janus Pannonius

Threat Hunter | Lord of the Sith

[Janus Pannonius @cyber_pannonius]

https://t.co/N6vjmYzcYJ

[Mehmet Ergene @Cyb3rMonk]

This is good info about Microsoft Defender internals.

https://t.co/BSHbSP8ibw

[Janus Pannonius @cyber_pannonius]

@chrissanders88 https://t.co/uU2pyknIJ3

[Janus Pannonius @cyber_pannonius]

@SpecterOps @unsigned_sh0rt You can even use iSCSI as C2 :)

https://t.co/Ce8mWcL6bF

[Janus Pannonius @cyber_pannonius]

@cyb3rops https://t.co/uU2pyknaTv

[Janus Pannonius @cyber_pannonius]

https://t.co/ZSqALcCCDJ

[Eric Zimmerman @EricRZimmerman]

1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)

✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less

Update with Get-ZimmermanTools 🧵 #DFIR

[Janus Pannonius @cyber_pannonius]

@d1rkmtr Aaa sorry…just saw this: bcdedit /set testsigning on :)

[Janus Pannonius @cyber_pannonius]

@d1rkmtr How you signed the driver?

[Janus Pannonius @cyber_pannonius]

@malmoeb Honestly, this isn't as rare as it seems. It depends on how mature the market is where the incident occurred. Sometimes total destruction leaves no firewall logs or machines, so creativity—not tools—saves you. I wonder how top DFIR experts from mature economies would handle it.

[Janus Pannonius @cyber_pannonius]

Provides 7 new IP addresses potentially connected to the mentioned group:
38.180.235[.]177
91.107.163[.]28
91.199.147[.]252
141.11.123[.]56
185.125.202[.]145
185.162.250[.]87
188.245.58[.]123

All with good reputation.

[Janus Pannonius @cyber_pannonius]

Pivot on Gamaredon Group (From @ValidinLLC Threat Profiles)
194.58.45[.]81

http.html_hash:-200658290 ssl.jarm:"28d28d28d00028d00042d42d0000005a3e96c1dfa4bdb24b8b3c04cae18cc3"

[Janus Pannonius @cyber_pannonius]

Lumma stealer - https://t.co/V9pzn6l46f

[Ulf Frisk @UlfFrisk]

Improvements to MemProcFS forensic file recovery in 5.12.6. More data is now recovered, with correct file sizes, and with file signing info!

MemProcFS super fast memory forensics and analysis: https://t.co/inOM3l2eyd

[Janus Pannonius @cyber_pannonius]

@kddx0178318 If you'd like to monitor the Lumma staging infrastructure, you can easily do so with URLscan: https://t.co/qzBjh7p0uE

[Janus Pannonius @cyber_pannonius]

@DebugPrivilege @DirectoryRanger 4771

[Ulf Frisk @UlfFrisk]

MemProcFS memory forensics now supports Windows Hibernation Files!

Thank You @k1nd0ne for your excellent blog entry about the file format!

https://t.co/inOM3l1GIF

[Yamato Security Tools @SecurityYamato]

Just started work on a new tool. Native sigma scanner for cloud logs. (Starting with AWS first). (Basically Hayabusa for cloud logs) It should be out later this year. Please contact us if you do AWS DFIR/Threat Hunting and are interested in helping out.

[Vincent Le Toux (Paris, France) @mysmartlogon]

I've added the rule A-DC-Coerce to test for potential vulnerability of Coerce attack (https://t.co/mj5HptSfIf)
Feedback of the wording / logic welcomed before the imminente release of the next Beta of PingCastle.

[Janus Pannonius @cyber_pannonius]

However, I'm puzzled as to why I couldn't find a similar rule in the Sigma public repository or in any public paper—there's only one for 4769. What might I be overlooking, and what are the potential pitfalls?

[Janus Pannonius @cyber_pannonius]

While experimenting with the S4U2Proxy Kerberos extension, I discovered a distinctive 4624 event on the destination with a populated transited service field.