Markus Lassfolk

Got a passion for Technology in general but with a big Cyber Security focus. VP for Incident Response @Truesec @[email protected]

[Markus Lassfolk @lassfolk]

@felipeallende @jorgeaq_17 @de_jong_paul @F1Media @F1TV under account settings.

[Markus Lassfolk @lassfolk]

f1tv - got it working by disabling multiview (under account settings) and watch normal stream 👍

[Johannes Bader @viql]

Today, I'm releasing the first version of a small web 🚀: https://t.co/WZMsLWpGEK

It provides IOCs and YARA rules collected semi-automatically from public blog posts and reports of almost 200 cybersecurity sites.

I hope it proves useful to some of you ... 🙏✨ #ThreatIntel

[Adam Chester 🏴‍☠️ @_xpn_]

This hack is brilliant, APT28 hopping into a target environment over wifi by compromising neighbouring companies and finding a dual-homed host within range.

https://t.co/mGWU5Hdwi6

And yet... they got caught doing this!

[Markus Lassfolk @lassfolk]

New breakout from Hyper-v guest to host.
Details here:
https://t.co/zineUndUsG

[Markus Lassfolk @lassfolk]

@david_obrien @mrcoups @CrowdStrike Yes, we have seen it take up to 15-20 reboots until you are lucky to get the updated file and problem is solved.

[Markus Lassfolk @lassfolk]

@x0rz What about disk-encrypted systems, ie with Bitlocker etc?

[Markus Lassfolk @lassfolk]

@vmesc4pe @_JohnHammond We do the same. Its great for automated flows and sharing, all machine-to-machine stuff, and as a database. But we use other tools to actually do the daily job, like OpenCTI and self developed things.

[sǝʌǝN sɐp pᴉʌɐD @david_das_neves]

Windows 11's new AI Recall feature raises security concerns. Therefore, check this KQL hunting query (see below) designed for Microsoft Defender for Endpoint users to detect any activations of AI Recall on your network which has been created by Steven Lim.

#ThreatHunting

[Johan Arwidmark @jarwidmark]

A friendly reminder that you are indeed responsible for backups even when using someone else’s data center.

[Markus Lassfolk @lassfolk]

We are hosting our monthly Community Evening in Stockholm (on-premises, not virtual), this time on the subject of 'Operational Technology' with a guest speaker from SANS.

Welcome!

Link for pre-Registering:

https://t.co/Bi14Pz73bp

[Markus Lassfolk @lassfolk]

Looks like we will have a busy summer...

[SinSinology @SinSinology]

Nothing to be scared about folks, just another CVSS 9.8 0day disclosed 0days ago that's gonna get code execution in 0 seconds (3 seconds to be more accurate), no limitation, no authentication, no shit, just straight up remote code execution
#IvantiForLife

[Markus Lassfolk @lassfolk]

@adbertram Great one! Had no idea.
Is there one for DomainNames.tld too? 😀

[Markus Lassfolk @lassfolk]

@tmels ohhh thank you, had missed that possibility! Will be a great extra project to work on.

[Markus Lassfolk @lassfolk]

Has anyone seen any way to visualize for Corp Users any changes IT does to o365/EntraID/Intune?

Im dreaming of an internal website showing anything that has changed, showing any new apps, policy changes etc etc

[Markus Lassfolk @lassfolk]

@Voulnet https://t.co/GmtWCjdDB8

[Inconspicuous @_yeah_but_nah_]

I cannot believe that you would post this child who clearly suffers from harlequin ichthyosis. This child was NOT burned by white phosphorus. The tightness of this child’s eyelids is due to the medical condition and NOT due to being burned alive. Shame on you. Do some research before posting your utter tripe. The only war crime is your X account, you foolish man.

[Markus Lassfolk @lassfolk]

@matthew1471 @markwilsonit Same! And i do run the early releases for Unifi without her knowing and pray to god every update that nothing will break 😁. #shadowIT

[Gi7w0rm @Gi7w0rm]

I highly suggest everyone in #CTI to check out the community version of @ValidinLLC.
Free availability of historical DNS data going several years back is absolutely amazing to have at hand.
I use this tool several times a week during my investigations, with great success.

[Valéry Rieß-Marchive | @valerymarchive.bsky.social @ValeryMarchive]

This 👇 is interesting and suggests that we can't anymore consider only the possibility of a common initial access broker #IAB in case of one victim claimed under more than one #ransomware brand.
I've counted 88 cases of cross-claims since Jan. 1st, 2023. Let's take a look...