Thomas Knudsen

Red Team | former CTI & @CuratedIntel Member

[Thomas Knudsen @Knudsec]

@BushidoToken awesome!

[Thomas Knudsen @Knudsec]

@sekoia_io @sekoia_io is it possible to get a link to the list of tools per actor? trying to map these out is difficult by tracing the tiny lines >.< its quite painful!

[Will @BushidoToken]

ICYMI: Excellent @ReliaQuest threat report on Scattered Spider, which is now running with the RansomHub RaaS

🔎 They used social engineering against the help desk to compromise the CFO’s account and then socially engineered the helpdesk to get DA too 🤦‍♂️

https://t.co/lXveoOnELd

[Yashraj Solanki @RustyNoob619]

As far as pivoting is concerned in CTI, you can pretty much do it all between @virustotal, @censysio & @urlscanio 🐧

I have taken all Artifact types and their features from the Awesome Pivot Atlas maintained by @AmitaiCo & mapped it against sources & where to find them

Links ⬇️

[Thomas Roccia 🤘 @fr0gger_]

I just came across a tool called AttackGen. It's a simple tool that generates incident scenarios based on a Threat Actor and suggests simulations and possible detections at a high level. #llm #python #threatintel

👉 code: https://t.co/RtnGJQPAEH
👉 app: https://t.co/b1C2kFq9kz

[Will @BushidoToken]

🔎 Tracking 5⃣ ALPHV/BlackCat 🐈‍⬛ ransomware affiliates in @MaltegoHQ #infosec #cti

[Florian Roth ⚡️ @cyb3rops]

Here is my first set of #YARA rules to detect the backdoored XZ packages

Report
https://t.co/jc7kA4tFsv

Rules
https://t.co/0k8gqZxHF9

#XZ #XZutil

[Matthew @embee_research]

Uncovering APT Infrastructure with Passive DNS Pivoting

This time we're taking a @MsftSecIntel APT report and identifying an additional 122 similar domains using @ValidinLLC

https://t.co/DU2zJli89i

#malware #threatintel

[CERT Orange Cyberdefense @CERTCyberdef]

🤝For the last months, our World Watch team collaborated with @sekoia_io TDR team to investigate and demystify Residential Proxies #RESIP and highlight their systemic growth and the transparency issues surrounding their sourcing ⤵️
https://t.co/KwJAx4RIYE

#cti @orangecyberdef

[Intel-Ops @Intel_Ops_io]

🔥New blog!

#Phobos Ransomware: Analysing associated infrastructure used by #8Base

Infrastructure: 45 domains, 22 IPs in 🇩🇪🇪🇪
Capability: #Smokeloader, #SystemBC

https://t.co/Yvh9GEkmFl

Findings below:

[Thomas Knudsen @Knudsec]

@embee_research @censysio dude, you have been killing it. Thank you for all the great resources these days!

[Clint Gibler @clintgibler]

📊 Cyber Threat Intel Metrics

Nice infographic breakdown across:
* Strategic - executives
* Tactical - managers
* Operational - security analysts

And varying levels of maturity

By @gertjanbruggink

https://t.co/IbQlVnGKqo

[Matthew @embee_research]

Decoding a Cobalt Strike Loader with Cyberchef and Emulation

A short video looking into a common CS loader and methods for extracting C2 addresses from Shellcode 😁

https://t.co/2DY4hgNw1k

#Malwareanalysis #Cobaltstrike

[Thomas Knudsen @Knudsec]

6. With all the issues, i still am using the mouse for the time being. Curious how the small one will be whenever i get that. As long as finalmouse keeps improving on the qc issues then i dont mind testing the mouse. Just needs more stability and consistency with the build.

[Thomas Knudsen @Knudsec]

Just got my first finalmouse (mouse) ever. Absolutely amazing AND amazing shipping to delivery time (im in Japan and it came 4 days earlier than expected!)

@finalmouse thank you so much for everything. Really pleased with everything on the mouse. One small critique below

[Thomas Knudsen @Knudsec]

5. the main 2 mouse clicks actually dont feel that great to me stability wise, and if you look at the front of the mouse when you press down on the main 1 and 2 click buttons, you can see that the buttons touch the base of the mouse.. so it basically can grind on it. needs tuning

[Thomas Knudsen @Knudsec]

@nyloudpackz @finalmouse yea i see now, thanks for sharing. For me this isnt an issue because im mainly gripping with relaxed claw and the back of my palm barely touches the mouse- just enough for stability of aim. To me flex isnt an issue if silent, its the creaking that would be because it can distract