Top Tweets for #AdversaryMethods

over 6 years ago

6/8 This is all tied to @reesespcres findings, who found some of our first live PEs related to this cluster https://t.co/2BFns7wWb4 I've also been coming across it for the last six months because this GODLUA stuff employs so many fun #adversarymethods: https://t.co/7YMxuf8Nbo

almost 7 years ago

Fun find of the day that uses several #adversarymethods: da83ba146c77d3d947fc564d8aecf499 1) DoH to https://t.co/kuQrqRw438 2) Downloads shellcode (?) from fullmeshnet\.eu 3) Masquerading as MingW-W64 4) User agent Mozilla/5.0 (i686-iamsatan-mingw32) Real pe arch is i666 :D :D

$stvemillertime's tweet photo. Fun find of the day that uses several #adversarymethods: da83ba146c77d3d947fc564d8aecf499 1) DoH to https://t.co/kuQrqRw438 2) Downloads shellcode (?) from fullmeshnet\.eu 3) Masquerading as MingW-W64 4) User agent Mozilla/5.0 (i686-iamsatan-mingw32) Real pe arch is i666 :D :D https://t.co/nwmfWCaLvd$

1

49

18

2

0

2

7

1

0

over 6 years ago

THREAD: new GODLUA compiled Oct/Nov 2019. Appears to be evolution of mal fam with new capas and #adversarymethods. 🆕 DNS over HTTPS (DoH) to *seven* different DoH services 🆕Support for KCP ("A Fast and Reliable ARQ Protocol") 🆕NEW! Root CA shenanigans? 1/8

1

71

36

4

0

over 6 years ago

One thing that passive backdoors sometimes do that active backdoors do not is respond to scans or requests to their open ports. You'll sometimes see PEs with hard-coded strings to mimic web server 404 responses to requests that dont include the magic/secret key. #AdversaryMethods

2

46

6

9

0

almost 7 years ago

In surveying #adversarymethods I often run across funny samples, such as this totally over the top #BLUEBOT (?) C2 at attack\.s2lol\.com PDB path of L:\Source\Botnet\obj\Release\svchosts.pdb How often is a PE with an array of 30 User-Agents not a piece of malware or a scanner?

$stvemillertime's tweet photo. In surveying #adversarymethods I often run across funny samples, such as this totally over the top #BLUEBOT (?) C2 at attack\.s2lol\.com PDB path of L:\Source\Botnet\obj\Release\svchosts.pdb How often is a PE with an array of 30 User-Agents not a piece of malware or a scanner? https://t.co/CAsCsx9dXK$

3

29

7

3

0

almost 7 years ago

Fun find of the day that uses several #adversarymethods: da83ba146c77d3d947fc564d8aecf499 1) DoH to https://t.co/kuQrqRw438 2) Downloads shellcode (?) from fullmeshnet\.eu 3) Masquerading as MingW-W64 4) User agent Mozilla/5.0 (i686-iamsatan-mingw32) Real pe arch is i666 :D :D

$stvemillertime's tweet photo. Fun find of the day that uses several #adversarymethods: da83ba146c77d3d947fc564d8aecf499 1) DoH to https://t.co/kuQrqRw438 2) Downloads shellcode (?) from fullmeshnet\.eu 3) Masquerading as MingW-W64 4) User agent Mozilla/5.0 (i686-iamsatan-mingw32) Real pe arch is i666 :D :D https://t.co/nwmfWCaLvd$

1

49

18

2

0

almost 7 years ago

@stvemillertime I'm finding PDB paths with the UNC path \\vmware-host\Shared Folders\ also have a high threat density! #AdversaryMethods

1

9

2

1

0

almost 7 years ago

\users\user (nocase) is one of those great #adversarymethods that transcends malware families and threat groups because very few "legit" programs are compiled on such an account or contain such a directory path in their PDB.

3

11

1

0

about 7 years ago

@andrewshead Great Q. Because it is only 4 characters, nocase will add a lot of noise. I often find fucks of various casings that appear randomly in base64 such as fUCk and FuCK. The best signal-to-noise ratio is actually around the main three fucks: "fuck" "FUCK" and "Fuck" #adversarymethods

0

4

0

over 7 years ago

This isn't the best example but here we see some Go path of the developed project and associated libraries. Save these paths as indexed toolmarks linked to a file object and let the clustering and tracking begin. #threathunting #adversarymethods

stvemillertime's tweet photo. This isn't the best example but here we see some Go path of the developed project and associated libraries. Save these paths as indexed toolmarks linked to a file object and let the clustering and tracking begin. #threathunting #adversarymethods https://t.co/uuRbRrzdo0

1

7

0

1

0

over 7 years ago

@reesespcres #adversarymethods &... #trashtics

0

3

0

over 7 years ago

And now our #AdversaryMethods team is full of them: @FuzzySec @BakedSec @danielhbohannon etc. https://t.co/35Ga6sMGlG You'd possibly mistake us for a red team... until you saw someone like me fumbling around in Kali 😁

almost 8 years ago

@FuzzySec @FireEye To stay ahead of targeted attackers, we have to anticipate their next move. We are busy watching them all day, but what post-exploitation adversary methods are we missing? Who better than @FuzzySec to help us set traps to discover & pursue the groups and techniques that matter?

0

13

1

0

12

1

0

over 7 years ago

Where does all this fall into @MITREattack? Is it Standard Cryptographic Protocol/T1032? Is it Remote Desktop Protocol/T1076? Is it Commonly Used Port/T1043? Is it Connection Proxy/T1090? Some #adversarymethods are multi-layered combos bringing granular TTPs together.

1

3

0

over 7 years ago

@shotgunner101 @avman1995 @Ledtech3 @voodoodahl1 @virustotal @360TIC @dvk01uk @James_inthe_box @JAMESWT_MHT @VK_Intel @securitydoggo @malware_traffic @cyb3rops @JayTHL @malwrhunterteam @WifiRumHam @xme @HybridAnalysis #AdversaryMethods has you covered: https://t.co/iu8AocvhsY

over 7 years ago

We love plaintext C2 beacons because: 1️⃣ They are easy to write signatures for (e.g., host/OS info) 2️⃣ Easy to immediately know infected host from a single alert/packet 👇 🆓 10+ @stvemillertime network signatures to get you started: https://t.co/RKXz03NP3y #trashtics #dailypcap

4

87

25

10

0

9

0

over 7 years ago

Now you can better secure your email from evasive #AdversaryMethods we've seen in-the-wild: 1⃣ Malicious archive passwords within images 🔥 2⃣ Guardrailing / environmental keying Serious detection engineering + data science: https://t.co/vyeitv3Cy4 BRING ON THE TELEMETRY!

ItsReallyNick's tweet photo. Now you can better secure your email from evasive #AdversaryMethods we've seen in-the-wild:
1⃣ Malicious archive passwords within images 🔥
2⃣ Guardrailing / environmental keying

Serious detection engineering + data science: https://t.co/vyeitv3Cy4

BRING ON THE TELEMETRY! https://t.co/icjLMvqxKy

1

23

7

3

0

over 7 years ago

@cyb3rops @BarryV Loving the 3rd rule type and have found similar value. We don't always #yara, but when we do, these #AdversaryMethods are what we work on! Great stuff as always.

ItsReallyNick's tweet photo. @cyb3rops @BarryV Loving the 3rd rule type and have found similar value.

We don't always #yara, but when we do, these #AdversaryMethods are what we work on!

Great stuff as always. https://t.co/irTmZwPNwI

0

13

2

0

James Condon @jameswcondon

over 7 years ago

While this report is about Linux, its worth noting that OpenSSH-based backdoors are both more common and more difficult to detect than you might think in the Windows world. #adversarymethods

over 7 years ago

Really cool write-up from @ESET on OpenSSH backdoors. I particularly like how they found new malware samples based on signatures the malware operators used to detect other OpenSSH backdoors. https://t.co/5eNdExz8Zk

2

92

50

3

0

1

9

1

0