eric ([email protected])

Cybercrime Threat Intelligence | Posts are not my employer's

[eric ([email protected]) @invoke_eric]

https://t.co/k1Nm6ADxn0 Great collaboration between CrowdStrike Services and CrowdStrike Intelligence @realparisi

[Tim Parisi @realparisi]

.@CrowdStrike has observed an increase in the targeting of #Telco and #BPO industries from a financially-motivated adversary SCATTERED SPIDER.
Mobile carrier networks are targeted, and in some cases SIM swapping has been confirmed. #infosec #dfir

https://t.co/ENVh6BGgBE

[eric ([email protected]) @invoke_eric]

A #jupyter notebook for triaging HTML files https://t.co/AoAjn8lVbj perhaps useful for anyone in #threatintelligence investigating phishing campaigns

[eric ([email protected]) @invoke_eric]

a day in the life of cyber threat intelligence analysts #cyberbakeoff

[eric ([email protected]) @invoke_eric]

Interesting #LOTS (Living Off Trusted Sites) that seems perfect for threat actors https://t.co/9aAhfw81tP: "Files are stored for 3 days and can be downloaded only once." - add that one to your threat hunting leads

[eric ([email protected]) @invoke_eric]

https://t.co/Ebwe3UhY2W IMO a good explanation of the #LOLBIN runonce.exe /AlternateShellStartup (https://t.co/SbfiK4EJKK)

[eric ([email protected]) @invoke_eric]

@urlscanio API usage example + #jq: curl "https[:]//urlscan[.]io/api/v1/search?q=domain:hivnd[.]com%20AND%20NOT%20page.domain:hivnd[.]com" | jq -r '.results[].task.url' - good for e.g. hunting formjacking victims

[eric ([email protected]) @invoke_eric]

gnomidea[.]xyz #cobaltstrike - FYI @Namecheap

[eric ([email protected]) @invoke_eric]

Hello #ThreatIntelligence community, here is a #jupyter notebook to triage infrastructure using the @virustotal API https://t.co/76qr7KvyRz

[eric ([email protected]) @invoke_eric]

#python #pandas tip: you can pass a dict to the pandas .astype() method to easily retype a whole df at one go, e.g.:
convert_dict = {'col1': float, 'col2': object}
df = df.astype(convert_dict)

[eric ([email protected]) @invoke_eric]

@a_tweeter_user @DissectMalware This is great, thank you!

[eric ([email protected]) @invoke_eric]

quick #dailyyara: xml.res file referencing external content (not necessarily malicious)
rule r{
strings:
$ = /Relationship Id="[a-zA-Z0-9]{3,6}" Type="http[s]?:\/\/[^"]{4,200}" Target="http[s]?:\/\/[^"]{4,80}" TargetMode="External"/
condition: all of them
}

[eric ([email protected]) @invoke_eric]

OneDrive URLs have cid values unique to each user https://t.co/2MZLGIG2oC; this can be useful for #threathunting purposes, as some adversaries reuse the same cid across multiple campaigns.

[eric ([email protected]) @invoke_eric]

Not all @censysio HTTP header fields are indexed, so if you try to search for these field names, you will get an error. However, you can still search the values using services.http.response.headers.unknown.value. This usually works.

[eric ([email protected]) @invoke_eric]

Hello dear #ThreatIntelligence community, here are a couple basic #jupyter notebooks for triaging infrastructure using @censysio or @PassiveTotal APIs https://t.co/qbeMVTkYuO with the power of Pandas

[eric ([email protected]) @invoke_eric]

Here is a @PassiveTotal python CLI client (https://t.co/G8xUyYTTxR) jq one-liner for “just give me all the resolutions”
pt-client pdns --query YOUR_DOMAIN_OR_IP_HERE | jq -r '.results[] | select(.recordType == "A") | {resolve} | join("")'

[eric ([email protected]) @invoke_eric]

#dailyyara tip I got from @larsborn - if your YARA rule is not for binaries (e.g. if it is for scripts), add a printability check under the condition, e.g.: and for all i in (1..100) : (uint8(i) != 0x0)

[eric ([email protected]) @invoke_eric]

thank you #Inter #skimmer operator for your convenient domain naming: interclub[.]website - shares WHOIS gordonlaver9@gmail[.]com with brilliantclub[.]website

[eric ([email protected]) @invoke_eric]

what is it like to work in #ThreatIntelligence you ask? cc @JershMagersh

[eric ([email protected]) @invoke_eric]

if you are not using https://t.co/rgSnQGAOPg, you don't know what you are missing

[eric ([email protected]) @invoke_eric]

https://t.co/cVIg8gnMLJ Great collaboration between #crowdstrike intelligence and services