Top Tweets for #PSExec

12 months ago

🛡️ PsExec un outil pour les SysAdmins 👉 (Re)découvrez notre tutoriel pas à pas : https://t.co/nMcfxrYENb 💡 Gain de temps, gestion centralisée, flexibilité : un vrai allié du quotidien pour les équipes IT. #Windows #SysAdmin #ITpro #PsExec https://t.co/nMcfxrYENb

IT-Connect.fr @ITConnect_fr

over 1 year ago

🔧 PsExec : l'outil que tout sysadmin devrait maîtriser ! Découvrez comment l'installer et l'utiliser pour exécuter des commandes et des programmes à distance sur des machines Windows 🚀 👉 https://t.co/Y4BDqLUkyA #SysAdmin #Windows #Outils #IT #PsExec https://t.co/Y4BDqLUkyA

Shanholo @ShanHolo

over 1 year ago

#VanHelsing #Ransomware ☣️5c254d25751269892b6f02d6c6384aef 1⃣📸Uses #PsExec from @Sysinternals 2⃣📸 Different configuration flags: --skipshadow, --system, --Directory, --File, --no-autostart, --Force, --no-wallpaper, --spread-smb, --spread-vcenter, --no-admin, etc.

ShanHolo's tweet photo. #VanHelsing #Ransomware

☣️5c254d25751269892b6f02d6c6384aef

1⃣📸Uses #PsExec from @Sysinternals
2⃣📸 Different configuration flags: --skipshadow, --system, --Directory, --File, --no-autostart, --Force, --no-wallpaper, --spread-smb, --spread-vcenter, --no-admin, etc. https://t.co/QojoEF3UcG

RAKESH KRISHNAN @RakeshKrish12

over 1 year ago

Yesterday, I ID'd a new variant of #VanHelsing #Ransomware that encrypts with .vanlocker! MD5 3e063dc0de937df5841cb9c2ff3e4651 5c254d25751269892b6f02d6c6384aef 193.37.69.225 193.37.69.162 https://t.co/tROBE7uw8I #OSINT #security #malware #darkweb #hack #infosec #netsec #TOR

RakeshKrish12's tweet photo. Yesterday, I ID'd a new variant of #VanHelsing #Ransomware that encrypts with .vanlocker!

MD5
3e063dc0de937df5841cb9c2ff3e4651
5c254d25751269892b6f02d6c6384aef

193.37.69.225
193.37.69.162

https://t.co/tROBE7uw8I

#OSINT #security #malware #darkweb #hack #infosec #netsec #TOR https://t.co/QkzFF5SNUD

reverseame @reverseame

over 1 year ago

PsExec’ing the right way and why zero trust is mandatory #SensePost #Psexec #ZeroTrust #Cybersecurity #Hacking https://t.co/etUP60wf0S

665

Intel 471 @Intel471Inc

over 1 year ago

Threat actors use #PsExec to blend malicious actions with legitimate activity. This case study shows how to spot artifacts like random service names and event logs (4697, 7045) that reveal their methods. Read more: https://t.co/ncOFQBzu3s #threathunting #threatintel

Zero Labs @ZeroNLabs

about 2 years ago

A hands on post about how to use #RPCFirewall and configure #Splunk to detect all sorts of RPC attacks: #Impacket, #DCSync, #PsExec, #dcomexe, #netview, #atexec https://t.co/Da4SgSLtqO

ZeroNLabs's tweet photo. A hands on post about how to use #RPCFirewall and configure #Splunk to detect all sorts of RPC attacks: #Impacket, #DCSync, #PsExec, #dcomexe, #netview, #atexec

https://t.co/Da4SgSLtqO https://t.co/ylZ1PK3JTw

sicehice @sicehice

over 2 years ago

#opendir hosting #jndi exploits and #psexec #plink #procdump #fscan 45.76.216.78:8000

Karol Paciorek @karol_paciorek

almost 3 years ago

Opendir exposing tools in China 124.223.55[.]73 🇨🇳 #mimikatz, #frp (fast reverse proxy), #PSExec, #smbexec https://t.co/Nrlc1OEEUC

222

136K

Keshav Thakur 🇮🇳 @d_kesh4v

almost 3 years ago

Sysinternals - I have just completed this room! Check it out: https://t.co/hzSZYr7xr1 #tryhackme #sysinternals #procmon #psexec #procexp #btsysinternalssg via @realtryhackme

Check Point Research

@_CPResearch_

about 3 years ago

Analyzing a #Rhysida ransomware intrusion case❗❗❗ 👩🏻‍💻 Analysis of the attackers TTPs 🛠️ Related Tools - PowerShell #SystemBC, #PsExec, #PortStarter ⛓️ Technical links and correlation with #ViceSociety Read more here --> https://t.co/3jP8PWOD8q

167

28K

Opalsec @0palsec

over 3 years ago

The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring #LOLDrivers.

468

Sagie Dulce @SagieDulce

over 3 years ago

Had a blast recording #RPCFirewall demos along with @TeachJing . We showed 2 different methods to do #PsExec #lateralmovement (one with only 1 RPC port available), and how to block via the #RPCFirewall. Detections can be imported from @sigma_hq https://t.co/d8dtsFfhee

Jacques Bensimon

@JacqBens

over 3 years ago

Seems @Sysinternals #PsExec v2.4 doesn't allow running processes as the local SYSTEM account (the Internet says all versions beyond v2.2 have this behavior). Is this true, @markrussinovich? On purpose?

JacqBens's tweet photo. Seems @Sysinternals #PsExec v2.4 doesn't allow running processes as the local SYSTEM account (the Internet says all versions beyond v2.2 have this behavior). Is this true, @markrussinovich? On purpose? https://t.co/RgUZ5pzxEM

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 3 years ago

#psexec psexec -h -i \\192.168.9.86 -u Administraó -p undostrescuatro cmd /C "cd c:/ids && FORFILES /S /M "*.rules" /C "cmd /c echo @path @fdate @fsize""

$seguridadyredes's tweet photo. #psexec psexec -h -i \\192.168.9.86 -u Administraó -p undostrescuatro cmd /C "cd c:/ids && FORFILES /S /M "*.rules" /C "cmd /c echo @path @fdate @fsize"" https://t.co/q7lPDdlKWP$

247

sn🥶vvcr💥sh @snovvcrash

over 3 years ago

I got curious about how easy it would be to bypass some of the static detections for the RemComSvc binary (which is over 10 years old) and yeah… Pretty easy 😂 https://t.co/U44Ik5RxFQ #psexec #impacket #remcom

snovvcrash's tweet photo. I got curious about how easy it would be to bypass some of the static detections for the RemComSvc binary (which is over 10 years old) and yeah… Pretty easy 😂

https://t.co/U44Ik5RxFQ

#psexec #impacket #remcom https://t.co/XF0yx4Vfna

Ash @_bin_Ash

over 3 years ago

Impacket's psexec drops a binary (RemCom) that is over 10 years old when creating the service it uses for command execution. May we all aspire to write tooling that is still relevant 10 years later. RemCom = goated 🐐 Ref: https://t.co/LTNRaflIKr RemCom: https://t.co/YrKw1nBtAt

_bin_Ash's tweet photo. Impacket's psexec drops a binary (RemCom) that is over 10 years old when creating the service it uses for command execution.

May we all aspire to write tooling that is still relevant 10 years later. RemCom = goated 🐐

Ref: https://t.co/LTNRaflIKr
RemCom: https://t.co/YrKw1nBtAt https://t.co/aQGZjUrIZD

153

69K

218

61K

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 3 years ago

#psexec -h -i \\192.168.1.12 -u Admin -p xxx POWERSHELL "Get-WinEvent -path 'C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx'| Where-Object {$_.Id -match 1116} |Select-Object TimeCreated, ID, ProviderName, LevelDisplayName, Message -First 5"

$seguridadyredes's tweet photo. #psexec -h -i \\192.168.1.12 -u Admin -p xxx POWERSHELL "Get-WinEvent -path 'C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx'| Where-Object {$_.Id -match 1116} |Select-Object TimeCreated, ID, ProviderName, LevelDisplayName, Message -First 5" https://t.co/ijpQRbRCgg$

303

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 3 years ago

#psexec / Sysinternals. psexec -h -i \\192.168.1.12 -u Administrador -p xxx POWERSHELL "get-winevent -path C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx | Select-Object -Property TimeCreated,ID,Message -First 50 | Format-List" | findstr "CommandLine"

$seguridadyredes's tweet photo. #psexec / Sysinternals. psexec -h -i \\192.168.1.12 -u Administrador -p xxx POWERSHELL "get-winevent -path C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx | Select-Object -Property TimeCreated,ID,Message -First 50 | Format-List" | findstr "CommandLine" https://t.co/xrEExLmgMT$

452

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 3 years ago

#psexec / Sysinternals. psexec -h -i \\192.168.1.200 -u Administrador -p undostrescuatro cmd /C FOR /R C:\ %i in (*) do @if %~zi gtr 1000000000 echo %i

$seguridadyredes's tweet photo. #psexec / Sysinternals. psexec -h -i \\192.168.1.200 -u Administrador -p undostrescuatro cmd /C FOR /R C:\ %i in (*) do @if %~zi gtr 1000000000 echo %i https://t.co/CfyIoaxRsj$

302

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 3 years ago

#psexec / Sysinternals. psexec -h -i \\192.168.1.100 -u Admin -p talycual wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size, VolumeName

$seguridadyredes's tweet photo. #psexec / Sysinternals. psexec -h -i \\192.168.1.100 -u Admin -p talycual wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size, VolumeName https://t.co/p7qtnIcWCf$

707

TrendAI™ Research

@trendai_RSRCH

over 3 years ago

Our blog entry offers a technical analysis of #Play ransomware, which exfiltrates its victim's data before running its malware via scheduled tasks and #PsExec. Read about its tactics here: https://t.co/wWDx9cCgUe

801

Top Tweets for #PSExec

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users