.@CrowdStrike has observed an increase in the targeting of #Telco and #BPO industries from a financially-motivated adversary SCATTERED SPIDER.
Mobile carrier networks are targeted, and in some cases SIM swapping has been confirmed. #infosec#dfir
https://t.co/ENVh6BGgBE
Interesting #LOTS (Living Off Trusted Sites) that seems perfect for threat actors https://t.co/9aAhfw81tP: "Files are stored for 3 days and can be downloaded only once." - add that one to your threat hunting leads
@urlscanio API usage example + #jq: curl "https[:]//urlscan[.]io/api/v1/search?q=domain:hivnd[.]com%20AND%20NOT%20page.domain:hivnd[.]com" | jq -r '.results[].task.url' - good for e.g. hunting formjacking victims
#python#pandas tip: you can pass a dict to the pandas .astype() method to easily retype a whole df at one go, e.g.:
convert_dict = {'col1': float, 'col2': object}
df = df.astype(convert_dict)
OneDrive URLs have cid values unique to each user https://t.co/2MZLGIG2oC; this can be useful for #threathunting purposes, as some adversaries reuse the same cid across multiple campaigns.
Not all @censysio HTTP header fields are indexed, so if you try to search for these field names, you will get an error. However, you can still search the values using services.http.response.headers.unknown.value. This usually works.
Hello dear #ThreatIntelligence community, here are a couple basic #jupyter notebooks for triaging infrastructure using @censysio or @PassiveTotal APIs https://t.co/qbeMVTkYuO with the power of Pandas
Here is a @PassiveTotal python CLI client (https://t.co/G8xUyYTTxR) jq one-liner for βjust give me all the resolutionsβ
pt-client pdns --query YOUR_DOMAIN_OR_IP_HERE | jq -r '.results[] | select(.recordType == "A") | {resolve} | join("")'
#dailyyara tip I got from @larsborn - if your YARA rule is not for binaries (e.g. if it is for scripts), add a printability check under the condition, e.g.: and for all i in (1..100) : (uint8(i) != 0x0)
thank you #Inter#skimmer operator for your convenient domain naming: interclub[.]website - shares WHOIS gordonlaver9@gmail[.]com with brilliantclub[.]website