#MALDocs - Twitter Hashtag

6 months ago

#CyberSecurity #MalwareAnalysis #ReverseEngineering #ThreatIntelligence #BlueTeam #Research #MalDocs #BlueTeam #Attacks #InfoSec #ThreatIntelligence #CyberThreats #DigitalForensics #BlueTeam

0

3

0

110

Blackstorm Security @blackstormsecbr

over 1 year ago

(PT_BR) O treinamento de MALICIOUS DOCUMENT ANALYSIS está com a próxima turma CONFIRMADA para início em 06/ABRIL/2025. Informações adicionais podem ser obtidas no website da Blackstorm Security. #dfir #incidentresponse #malware #cybersecurity #threathunting #blueteam #maldocs

blackstormsecbr's tweet photo. (PT_BR)

O treinamento de MALICIOUS DOCUMENT ANALYSIS está com a próxima turma CONFIRMADA para início em 06/ABRIL/2025.

Informações adicionais podem ser obtidas no website da Blackstorm Security.

#dfir #incidentresponse #malware #cybersecurity #threathunting #blueteam #maldocs https://t.co/7yMGh1nIfh

0

2

1

0

379

Blackstorm Security @blackstormsecbr

over 2 years ago

(PT_BR) O treinamento de MALICIOUS DOCUMENT ANALYSIS está CONFIRMADA para início em 22/JUNHO/2024. Informações adicionais podem ser obtidas no website da Blackstorm Security e também enviando uma mensagem para o endereço de email marcado no banner. #maldocs

blackstormsecbr's tweet photo. (PT_BR)

O treinamento de MALICIOUS DOCUMENT ANALYSIS está CONFIRMADA para início em 22/JUNHO/2024.

Informações adicionais podem ser obtidas no website da Blackstorm Security e também enviando uma mensagem para o endereço de email marcado no banner.

#maldocs https://t.co/mtXhb2Yqig

0

2

1

0

146

Matthew

@embee_research

over 2 years ago

5/ Obtaining Macros With Microsoft Word Microsoft word (on a safe VM) will also allow you to inspect #maldocs. You can do this by opening up a suspicious document, and browsing to View -> Macros -> View Macros -> Edit.

embee_research's tweet photo. 5/ Obtaining Macros With Microsoft Word

Microsoft word (on a safe VM) will also allow you to inspect #maldocs.

You can do this by opening up a suspicious document, and browsing to View -> Macros -> View Macros -> Edit. https://t.co/kP4zdeiFEx

1

5

0

876

Matthew

@embee_research

over 2 years ago

Three Simple Methods For Analysing Malicious Documents A quick overview of olevba, Microsoft Word, and Procmon for analysing malware documents and extracting embedded macro content. [1/10] 🧵 #malware #maldocs

embee_research's tweet photo. Three Simple Methods For Analysing Malicious Documents

A quick overview of olevba, Microsoft Word, and Procmon for analysing malware documents and extracting embedded macro content.

[1/10] 🧵

#malware #maldocs https://t.co/9bxQQfgw0g

3

393

94

322

38K

Josh Stroschein | The Cyber Yeti

@jstrosch

over 2 years ago

�� icymi - I've put together my first #cheat #sheet around #maldocs, you can download a PDF version from 👇 ✅ https://t.co/JyHBnYi6lo Covers the tools, common commands, and other information you need to know when analyzing malicious documents, such as Word, OneNote and PDF.

jstrosch's tweet photo. �� icymi - I've put together my first #cheat #sheet around #maldocs, you can download a PDF version from 👇

✅ https://t.co/JyHBnYi6lo

Covers the tools, common commands, and other information you need to know when analyzing malicious documents, such as Word, OneNote and PDF. https://t.co/itDhowt5LU

1

93

35

70

11K

Josh Stroschein | The Cyber Yeti

@jstrosch

over 2 years ago

🚨 I've put together my first #cheat #sheet around #maldocs, you can download a PDF version from 👇 ✅ https://t.co/iruVT35nFh Covers the tools, common commands, and other information you need to know when analyzing malicious documents, such as Word, OneNote and PDF.

jstrosch's tweet photo. 🚨 I've put together my first #cheat #sheet around #maldocs, you can download a PDF version from 👇

✅ https://t.co/iruVT35nFh

Covers the tools, common commands, and other information you need to know when analyzing malicious documents, such as Word, OneNote and PDF. https://t.co/Uv5KcM0f7P

2

186

58

126

15K

Jen S @jens2763

over 2 years ago

🚨Ummm... isn't this a form of bribery and/or obstruction? #MALDocs #JudgeCannon #JackSmith

Gardeningfun @Gardendelightfu

over 2 years ago

Judge Cannon works for tRump and is working to earn that promised seat on the Supreme Court.

1

0

660

1

4

3

0

223

Threat Intelligence @threatintel

over 2 years ago

#ThreatProtection #Maldocs exploiting old #vulnerabilities are still used to deliver malicious payloads. Read more: https://t.co/BZTgtEVu3k

threatintel's tweet photo. #ThreatProtection #Maldocs exploiting old #vulnerabilities are still used to deliver malicious payloads. Read more: https://t.co/BZTgtEVu3k https://t.co/Kun5kSIuhF

0

2

1

0

Josh Stroschein | The Cyber Yeti

@jstrosch

over 2 years ago

2/2 And while #maldocs aren't as popular, these are good primers on the subject and also help to see/create an analysis workflow 👇 Getting Started w/ Malicous Office docs: https://t.co/bQkBR4O470 Getting Started w/ Malicious Excel docs: https://t.co/p2fFzV1Qrw

0

2

1

247

͏Postcards4USA 🟧 @postcards4USA

over 2 years ago

So, they were trying to abbreviate on @MSNBC chyron when discussing the Mar-A-Lago classified documents case & just shortened it to “Mal Docs” - which is perfect, imho, for a hashtag for 37 of the 91 felony counts against the former guy. #MalDocs Whadya say? PS #TrumpIsGuilty

postcards4USA's tweet photo. So, they were trying to abbreviate on @MSNBC chyron when discussing the Mar-A-Lago classified documents case & just shortened it to “Mal Docs” - which is perfect, imho, for a hashtag for 37 of the 91 felony counts against the former guy.
#MalDocs
Whadya say?

PS #TrumpIsGuilty https://t.co/L5qHXVoQn7

0

11

8

0

406

Eric Burns 🏳️‍🌈🇺🇦✊🏾🤙🏾🇧🇷 @EricBur41811852

over 3 years ago

@svdate Uh, @kaitlancollins the ball is squarely in your court. Ask these questions. It’s not like the entirety of your career’s credibility rests on what happens Monday or anything. #TrumpCommittedSedition #HoldHisFeetToTheFire #Sexism #Racism #Corruption #MALdocs

0

1

0

36

Sophos X-Ops @SophosXOps

over 3 years ago

Our coverage of this #malware campaign includes a breakdown of the attack chain, IOCs, and some other curious details. People unfamiliar with OneNote as a weaponized document format should get used to this; #QakNote #maldocs are probably here to stay. 6/6 https://t.co/JC7kouY5ng

0

5

4

1

1K

NoVirusThanks @novirusthanks

over 3 years ago

New Blog Article: Not Just #OneNote, Also Microsoft Publisher #Maldocs can Deliver #Malware | Execution flow is document[.]pub (MSPUB.EXE) -> cmd.exe -> mshta.exe ➨ https://t.co/uCxyglXLXN #Cybersecurity #Cyberdefense #InfoSec #OSINT

0

10

5

0

820

Blackstorm Security @blackstormsecbr

almost 4 years ago

Black Basta: Riding the Crimeware Sleigh: https://t.co/EUjEP6XQSc #malware #qakbot #qbot #cybersecurity #threatintelligence #threatintelligence #threatinformation #cybercrime #blueteam #maldocs

0

1

0

al3x 🐈‍⬛ @cyb3rkitties

almost 4 years ago

waking up at 6 am — totally worth it to watch this webinar with @DidierStevens and take all the notes! #maldocs #malwareanalysis

NVISO @NVISOsecurity

almost 4 years ago

A PDF document containing a DOCX file, that downloads a RTF, that executes shellcode will be the star of @DidierStevens upcoming brownbag #webinar. He’ll use this single "turducken" document to demonstrate 4 different analysis techniques. Register here: https://t.co/fgxfaQdqQn

NVISOsecurity's tweet photo. A PDF document containing a DOCX file, that downloads a RTF, that executes shellcode will be the star of @DidierStevens upcoming brownbag #webinar.

He’ll use this single "turducken" document to demonstrate 4 different analysis techniques.

Register here: https://t.co/fgxfaQdqQn https://t.co/KG822v0I5i

1

32

9

5

0

5

3

0

InQuest @InQuest

about 4 years ago

Not sure what these bad actors fancy about Jon McGlone, but waves of #maldocs obfuscate stage-two with his website. Read through the attack-chain within this new blog: RTF files, Shellcode and More Shenanigans https://t.co/lPsADyLBeh #ThreatIntel #malware

InQuest's tweet photo. Not sure what these bad actors fancy about Jon McGlone, but waves of #maldocs obfuscate stage-two with his website.

Read through the attack-chain within this new blog:
RTF files, Shellcode and More Shenanigans

https://t.co/lPsADyLBeh

#ThreatIntel
#malware https://t.co/jjLKHIjJpw

0

2

3

0

InQuest @InQuest

about 4 years ago

A few days ago we discovered an interesting document spoofing contract for the supply of services to an energy company from southern Iran. Since this family of #maldocs was not previously known, we call it Green Stone. https://t.co/R16NumItAD #ThreatHunting #ThreatIntel

InQuest's tweet photo. A few days ago we discovered an interesting document spoofing contract for the supply of services to an energy company from southern Iran.

Since this family of #maldocs was not previously known, we call it Green Stone.

https://t.co/R16NumItAD

#ThreatHunting #ThreatIntel https://t.co/rZYHU0OScY

0

8

4

0

Sophos X-Ops @SophosXOps

over 4 years ago

Researchers can set alerts in Virustotal to flag when a file of interest gets submitted. I get periodic bursts of these -40444 #maldocs, but there was something notable about the document titles in this batch last week: They all parrot specific Russian disinformation topics. 2/16