kidrek

[kidrek @k1dr3k]

@ITConnect_fr After Zircolite, now #LogsTotal by Wagga ;)

[kidrek @k1dr3k]

Thanks to @SOC_Prime for your LogTotal tool (https://t.co/0WjzQkyHDJ), but I prefer LogsTotal, by Wagga—a project launched several months ago.
Source: https://t.co/7mNcBI1tAH

I really like this coincidence regarding the name 😋.

[Samir @SBousseaden]

process where event.type == "start" and https://t.co/GwmedTiO5h :"SnippingTool.exe" and process.args: ("ms-screensketch:edit?&filePath=%5C%5C*", "ms-screensketch:edit?&filePath=http*", "ms-screensketch:edit?&filePath=\\\\*")

[kidrek @k1dr3k]

@sth4ck @helloasso Just for information. There’s no link on https://t.co/aC0SYqrS6E on the tickets button at this moment.

[Karsten Hahn @struppigel]

CrystalPDF.exe is another one of these malicious PDF editors. Written in F#. 0/73 on VT.

https://t.co/sjRDWU6YBC

Signer: VAST LAKE LTD
Downloaded from: crystalpdf(dot)com

[Cyber_OSINT @Cyber_O51NT]

Ukraine's military intelligence agency confirmed its involvement with two volunteer hacking groups in a cyberattack on Gaskar Group, a major Russian drone supplier. #CyberAttack #Ukraine #Russia https://t.co/eQjyTrbzdq

[SANS.edu Internet Storm Center @sans_isc]

Hiding Payloads in Linux Extended File Attributes https://t.co/5faWPQaPM2

[bearstech @bearstech]

La @CNIL a publié le manga "L’Agence Privacy“ pour éveiller les ados aux risques numériques

👉 https://t.co/LmAwWuQXix

[kidrek @k1dr3k]

@binitamshah Thx for sharing. Why not use plaso/log2timeline to process collected data?

[John Althouse @4A4133]

Announcing the JA4+ Database!
https://t.co/ZqhIkM1dNn

Under *very* active development but ready for use. Expect orders of magnitude more data and JA4+ combinations over the next few months. I recommend downloading the DB and loading up in your data explorer of choice for now.

Everyone has a different use-case for JA4+ so we're trying to make it easy to find what you're looking for. Below are some examples you can do in a data explorer like Elastic.

JA4 to JA4H
JA4 to User-Agent String
JA4 to Application
JA4 to Library
JA4T to Device
JA4X to Device
JA4X to Application
JA4X to Issuers
JA4X to JA4T
etc. etc. etc.

There are so many combinations and use cases for each.

Please send me any feedback, improvement suggestions.

[M.FRAYSSE @Matfraysse]

🚨TUTO déverrouillage illicite de téléphone et piratage de compte iCloud.
J’ai été témoin ce jour de l’ingéniosité de voleurs / pirates.
Je vous livre quelques-uns de leurs secrets que j’ai pu analyser après coup.

[Dark Web Informer @DarkWebInformer]

IntelBroker has posted more screenshots of his access to Zscaler. Pretty damaging.

#DarkWebInformer #DarkWeb #Cybersecurity #Cyberattack #Cybercrime #Infosec #CTI #Zscaler

[Dark Web Informer @DarkWebInformer]

⚠️#OSINT⚠️SpyScrap's purpose is to recolect information from different sources like Google, Tinder, Twitter, Instagram, Yandex, Facebook, and BOE.

#CTI #DarkWeb #DarkWebInformer #Cybercrime #Cybersecurity #Cyberattack #Infosec #SpyScrap

GitHub: https://t.co/CLegO3fBlu

[Andres Bohren 🇨🇭 @andresbohren]

🤔 This week "THREAT_INTELLIGENCE" #Licence appeared in my #M365 Tenant. Anyone knows what that does?
https://t.co/1HJjvh3Eh4

[OpexNews @OpexNews]

🚨 La #Cnil autorise le stockage de données de l'Assurance maladie chez #Microsoft !

« Faute de prestataire européen » (🫣), la Cnil a validé l'hébergement de données de santé des Français chez Microsoft, pour une durée de 3 ans.

Et ce, malgré « le risque de communication à des puissances étrangères ». #souveraineté #cloudact

➡️ https://t.co/2hcDtThH1t

[John Althouse @4A4133]

All of JA4+ is now on https://t.co/ggdKGaIQRW for you to play with, upload your pcaps, whatever. Login: arkime/arkime

A great example of how to search using * in a JA4+ fingerprint section allowing you to easily find similar fingerprints, something JA3 could never do:

[Corben Leo @hacker_]

I've made $500k+ from SSRF vulnerabilities.

Here are my tricks:

[John Althouse @4A4133]

Current Qakbot C2s:

Cross-referencing JA4+ data on https://t.co/NI4TG0olfs and utilizing the https://t.co/8VXSH8ocFA's JA4X Feed, it was easy to put together this list of C2/proxy infrastructure that matches Qakbot.

[John Althouse @4A4133]

JA4X on https://t.co/8VXSH8ocFA is now public!

All the Qakbot C2s:
https://t.co/61WpDLFAuF

Sliver C2s:
https://t.co/U9k4Bc6FNl

SoftEther VPNs:
https://t.co/e9efk5ImG5
(click Visible Services for the list)

Let me know if you find something new and interesting!

[Cyber Detective💙💛 @cyb_detective]

Please take a look at our joint project with @netlas_io:

NETLAS COOKBOOK

Will be useful for everyone who wants to learn how to use IP search engines for #OSINT and automate this process using various REST APIs (not only Netlas).

https://t.co/ZEHjKxiwRJ