dfirfpi

[Jake Williams @MalwareJake]

If you're starting out in security and find the breadth of stuff you "need to know" daunting, I want to give you some perspective:
1. The field has broadened - dramatically. The "baseline knowledge" grows every year. Anyone saying otherwise is lying or uninformed. 1/

[SANS Offensive Operations @SANSOffensive]

The SANS #RansomwareSummit is open for registration!

Join @rj_chap Live Online as we bring together #Cybersecurity professionals for in-depth talks focused on #Ransomware prevention, detection, response, and recovery.

✍️ Register For Free: https://t.co/qbfoBhXWIY

[Matthew Green 🌻 @mgreen27]

@nas_bench We target anything from C:\\Users as first path https://t.co/gJ6xC68iTp

[SANS Institute, EMEA @SANSEMEA]

Coming 🔜: #SANS 🇪🇸 Madrid, March 2023

🔦 #SANS In-Person Course Spotlight

#FOR508: 🗣️@dfirfpi
#FOR509: 🗣️Korstiaan Stam
#ICS410: 🗣️ @meeas

➕ Search For More Courses: https://t.co/lLjyFhrkop

#SANSTraining #EMEA
#CyberSecurityTraining

[Silvia Spallarossa @SilviaSpallaro1]

@mattiaep @domenicacrognal @sansforensics Thanks to you and @dfirfpi for giving me this great opportunity ❤️ and thanks to all @_RealityNet (especially @KlodiaMaida) for all your support in these months ❤️

[Mattia Epifani @mattiaep]

Congrats @SilviaSpallaro1 for your #GASF cert!
Very well deserved, so proud of you! And thanks @domenicacrognal for teaching her :) #for585 @sansforensics

[Grzegorz Tworek @0gtweet]

"write.exe" is just ShellExecute() to wordpad.exe. And ShellExecute() reads HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths before reading HKLM.
Which means, you can use "write" to launch anything if you create "wordpad.exe" subkey.
And it explains why I love Windows.🙃

[payloadartist @payloadartist]

Why you should never ever ever use pixelation as a redaction technique 🙈

https://t.co/hGaam08mmr

#infosec #cybersecurity #dataprivacy

[Dr. Nestori Syynimaa @DrAzureAD]

New #AADInternals version and related blog post (with multicolor arrows) out now!

"Stealing and faking Azure AD device identities":
https://t.co/n9sydZ4AeI

Credits to @gentilkiwi/#Mimikatz!

#infosec #redteam #blueteam

[Malwrologist @DissectMalware]

Puzzled why a yara rule did or didn't match?

Let me introduce https://t.co/cY3G5MeOk6, a web-based #yara #debugger!

With #YaraDbg, you can see the:
1⃣ evaluation steps
2⃣ matched strings
3⃣ relationship among the rules

[mr.d0x @mrd0x]

Procdump works against Defender with a simple rename. It quarantines the generated .dmp file but you have a few seconds to make a copy of it before it's removed.

I've seen other security solutions that do this, try to copy the file quickly before it's removed.

[Pentest Laboratories @pentestlabltd]

📢 New Article Released!
📝 Domain Escalation - ShadowCoerce
https://t.co/U1m8ise69P
#pentestlaboratories #redteam #redteaming

[mr.d0x @mrd0x]

Bypass Defender AV static detection:

If you name a malicious file DumpStack.log Defender doesn't scan it.

[Brian Maloney @bmmaloney97]

I’ll just leave this here. @chadtilbury @Hexacorn @phillmoore

https://t.co/pNS6m6l3Z2

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Don't you think #mimikatz 3 is more sexy with #kekeo inside?

Still compatible with Windows XP,
Without custom compiler this time (VS2019+ Community+)
Without commercial ASN1 library

[SANS Institute, EMEA @SANSEMEA]

SANS Live Online Europe February 2022 Volume 1

SEC504 w/ @bettersafetynet
SEC488 w/ @RogerOfarril
FOR508 w/ @dfirfpi
SEC510 w/ @KennethGHartman
FOR610 w/ @jclausing
MGT514 w/ @_JoeSullivan

Register 👉 https://t.co/UQPc0rNKmn

[SANS Institute, EMEA @SANSEMEA]

SANS Live Online Europe January 2022 Volume 1

#FOR500 w/ @lee_whitfield
#FOR508 w/ @dfirfpi
#SEC660 w/ @mchllmmns
#SEC530 w/ @Greg_Scheidel
#MGT551 w/ @markaorlando

Register 👉 https://t.co/7PcvyZpv9E

[Lorenzo Maffia @Maff1t]

InjectionTracer v0.1 is OUT!
A tool that aims to help you to 𝐢𝐝𝐞𝐧𝐭𝐢𝐟𝐲, 𝐝𝐞𝐛𝐮𝐠 𝐚𝐧𝐝 𝐝𝐮𝐦𝐩 the injected code.
It supports most of the known process injection techniques.
https://t.co/ykuq6R2LK8

[Mattia Epifani @mattiaep]

Apple TV 4 with iOS 14.7.
Jailbreak with @checkra1n
Full file system with @ElcomSoft and @MagnetForensics
Processing with @AlexisBrignoni iLEAPP and @iamevltwin APOLLO
Nice :)