RENJU JACOB

#infomrationsecurity,
#football,
#messi,
#Splunk,
#Azure sentinel#,
Phil 4:6

[Bert-Jan 🛡️ @BertJanCyber]

Added some more #KQL queries to the repo. 🏹
- Scheduled Task AppData
- Defender AV Exclusion Events
- Rare .lnk File Created on Desktop

https://t.co/EcTUgZCwcy

The queries were already supported in #KustoHawk

[RENJU JACOB @jacob_renju]

https://t.co/lQo33Feyys

[Thomas Roccia 🤘 @fr0gger_]

Interesting new project: 'LOLbin-CTI Driven'. It's an app that visually demonstrates how a LOLbin can be used during an intrusion. And it uses the STIX format. 👍
#infosec #malware #lolbin #threatintel

👉App: https://t.co/paV7I9UtvJ
👉Project: https://t.co/Nq6eaqwOJ1

[DirectoryRanger @DirectoryRanger]

Windows Triaging with Powershell #DFIR
Part 1: Parsing Event Logs https://t.co/PoN36iMUll
Part 2: Artifacts Collection https://t.co/Csp4ogQieZ

[proxylife @pr0xylife]

#TA577 - Back on the scene pushing #Darkgate

Time to resume tracking operations, welcome back Tramp.

Distro 👇

url > zip > lnk
url > xll
pdf > url > xll > msi

Samples 👇

https://t.co/IF3KJIbPjf

https://t.co/b49huhI9FI

https://t.co/YNz4LgCWXO

https://t.co/2oP6ZKlNUL

[Wayne Rooney @WayneRooney]

Nothing has changed. 🤷🏻‍♂️🐐

[Jamie Carragher @Carra23]

#Messi𓃵 the best there has ever been!

[Max_Malyutin @Max_Mal_]

#Qakbot LNK Infection TTPs & IOCs

#DFIR Exec Flow: LNK > CMD > curl & regsvr32

Distro URL: p://172.96.137[.]171/thanItsHis[.]dat

Payload location: C:\Users\{User}\AppData\Local\Temp\alsoOnThese.rtf

Payload DLL exports: DllInstall, DllRegisterServer

[Jazi @h2jazi]

#Follina (cve-2022-30190)
THE FUTURE OF OCC MEETINGS IN 2022.docx
d16427f5cff23f456934e7aecaba226c

https://consumerfinanceguide[.]com/blog/index/blog.html
(The domain is registered 8 days ago)

The payload seems to be #CobaltStrike
gpupdate.exe
8336a6aeb41b066918c5cc7f27a4c36b

[Kimberly @StopMalvertisin]

#Follina CVE-2022-30190
Payment Notification.pdf.RTF
https://t.co/cfOw1ifHdi
Not your normal "default Apache2 welcome page"
URL: http://simpant[.]sc[.]ug/ccc/expl.html
https://t.co/YwWuCnwWPi

[Florian Roth ⚡️ @cyb3rops]

In phishing mail attachments we often find a suspicious name or double extension (e.g. .doc.exe) in the directory records of an attached ZIP archive

Let's use that for a generic #YARA rule that detects ZIP archives with these characteristics

https://t.co/beSnZttzv0

[Florian Roth ⚡️ @cyb3rops]

Let's detect these ZIP attachments with .lnk file contents

- magic header check
- size
- location of string ".lnk" relative to end of file

Example
https://t.co/pvgGLcGZvI

[Florian Roth ⚡️ @cyb3rops]

I like their sense of humor

https://t.co/hhBIwdGNVv

[Gary Neville @GNev2]

Get out of our club

[The Register @TheRegister]

Now Lapsus$ claims on its Telegram channel that it's compromised Okta as well as Microsoft and LG Electronics lately.

It previously hit Nvidia, Samsung, and others. Context: https://t.co/TdSNooeiQW

Further background: https://t.co/v0EBteEyeu

[vx-underground @vxunderground]

Conti ransomware group's web domains are currently offline.

Intel via @ido_cohen2

[vx-underground @vxunderground]

.@TrendMicro released a paper on a new ransomware variant named "Nokoyawa". TrendMicro believes Nokoyawa to be connected to the notorious HIVE ransomware group.

HIVE recently ransomed Rompetrol, the 2nd largest gas-station network in Romania.

Download: https://t.co/zpxqOAxMhX

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Always nice to see v143 (Visual Studio 2022) C compiler able to create C binaries for Windows XP #mimikatz

[Damian Menscher @menscher]

A botnet of thousands of compromised #GitLab instances (exploited via CVE-2021-22205) is generating DDoS attacks in excess of 1 Tbps. Please patch your servers!

[Tommy M (TheAnalyst) @ffforward]

So again @Microsoft @onedrive hasn't acted on abuse reports since Thursday. Now #Hancitor is using it for doc delivery and #BazaLoader #BazarLoader is using it for zip > iso > lnk/DLL. 374 files not acted on, every single one will lead to #ransomware several times over!