ImPureMotion

The Cyberz

[ImPureMotion @ImPureMotion]

@Kostastsale Awesome stuff - good recent use case from (https://t.co/pD0zru6vZb) where xcopy was used to rename rundll32 to entails.exe

tweaking the regex a bit if you have cmdline parsed out:

(xcopy|copy|copy-item|cp)\s+c:\\windows\\(system32|syswow64)\\[a-zA-Z0-9_\-]{1,}\.exe\s\w:\\.*\\?

[ImPureMotion @ImPureMotion]

@TheDFIRReport Fantastic stuff

[The DFIR Report @TheDFIRReport]

HTML Smuggling Leads to Domain Wide Ransomware

➡️Initial Access: Thread-Hijacked Email > HTML Attachment
➡️Credentials: LSASS Access, SessionGopher
➡️Lateral Movement: RDP, PsExec
➡️C2: IcedID, Cobalt Strike
➡️Impact: Nokoyawa Ransomware

https://t.co/ncnD7VdKDI

1/X

[ImPureMotion @ImPureMotion]

@0x4D31 @ateixei Threat Detection Engineering #TDE

[ImPureMotion @ImPureMotion]

@msuiche Scanning inbound email

[ImPureMotion @ImPureMotion]

@elonmusk Can we add folders to organize bookmarks?

[ImPureMotion @ImPureMotion]

@dcunited @orthovirginia https://t.co/Q58fgkZNFq

[ImPureMotion @ImPureMotion]

@phage_nz @pr0xylife Similar lure body format seen in https://t.co/ig9AqHBQgb

[ImPureMotion @ImPureMotion]

@securitydoggo 👀

[ImPureMotion @ImPureMotion]

@securitydoggo The tattoo should read "I <3 Active Lists"

[ImPureMotion @ImPureMotion]

@securitydoggo Have them try to beat you at Regex Golf:
https://t.co/5AXIsKsyTV

[MalwareParty @MalwareParty]

Operation JOKAA(RR)

#molerats #gazacybergang #apt #malware #infosec

https://t.co/9mx6zDpimj

[ImPureMotion @ImPureMotion]

@DrunkBinary @unpacker @jfslowik @cyb3rops @0stracon @markus_neis a636cd2f1ba46a9af23f9c0a24f8ee4e

[ImPureMotion @ImPureMotion]

@securitydoggo Would be me exiting after no VT

[ImPureMotion @ImPureMotion]

@securitydoggo no more VT? :(

[ImPureMotion @ImPureMotion]

@ItsReallyNick @securitydoggo @James_inthe_box @lotus_ruan @PureReactions @_jsoo_ @bartblaze @blu3_team Hash for it: c22937cee87b45ba18c16318533648fb

[ImPureMotion @ImPureMotion]

@ItsReallyNick @securitydoggo @James_inthe_box @lotus_ruan @PureReactions @_jsoo_ @bartblaze @blu3_team Another one:

講座登入檢視意見回饋操作說明.doc

Lecture Login View Feedback Feedback Instructions .doc

[ImPureMotion @ImPureMotion]

@securitydoggo

[ClearSky Cyber Security @ClearskySec]

Iranian #Oilrig campaign decoy: "User list must change password.xls", target in Saudi Arabia.

C2: coldflys[.]com

Further analysis:
https://t.co/v3QUrtI0zI

Leads and analysis with @ImPureMotion and @blu3_team

[ClearSky Cyber Security @ClearskySec]

#AridViper uses pastes on https://t.co/UqejdoARjB for second stage scripts delivery

Recent sample: محضر اجتماع اليوم - (Minutes of today 's meeting)

Details and Indicators in Raw Threat Intelligence:
https://t.co/5pPpv1cQyA

Credit @ImPureMotion