Damien van der Linden

Cybersecurity || Microsoft Sentinel/XDR enthousiast || Hobby bughunter

[Damien van der Linden @LindenSec]

🔍 New on the blog: Choking Microsoft Defender with native Windows QoS policies (EDRChoker Explained)

Defender catches @TwoSevenOneT's binary, but that doesn't stop me from using Powershell to achieve the same. Full explaination @
https://t.co/251Ca0tUY7

[Damien van der Linden @LindenSec]

And last week I encountered a mix of Device Code Phishing and ClickFix (or well, ConsentFix rather).

Full blog: https://t.co/ZWjoeYiOcr

[Damien van der Linden @LindenSec]

Dissected a ClickFix attack using the blockchain as C2 infrastructure. 4 smart contracts, anti-sandbox evasion, and an attacker updating payloads in real-time.

One ASR rule stopped the entire chain.

Full investigation found here:

https://t.co/z1RPGNMFnM

#microsoft #clickfix

[Damien van der Linden @LindenSec]

🎮 NEW BLOG: Breaking into Cybersecurity: A Real Guide from Someone Who Took the Scenic Route

A personal blog about how I got into cybersecurity, and how you can too! (Spoiler: I mainly played World of Warcraft)

https://t.co/DnMjnEPEKC

[Damien van der Linden @LindenSec]

@cowbe0x004 Sorry for the late reply! I have added them because their behaviour is very, very similar to what the PDF Editor.exe did before it turned into malware. Massive ad-campaign, some slight recon and may or may not turn into an infostealer. Still monitoring it, can't say for sure :(

[Damien van der Linden @LindenSec]

Don't trust those free PDF editors!📄➡️💀

Been hunting the ManualFinder / PDF Editor campaign that went rampant.

Built a dynamic KQL query that pulls IOCs from GitHub + risk scores devices to cut through the noise.

🔗Full write-up: https://t.co/yj4immW4p5

#ThreatHunting #KQL

[Damien van der Linden @LindenSec]

@cowbe0x004 Glad it helps! The obfuscated .js file is indeed typical, the calls to the randomly generated domains are typically the C2 servers, so if you see those calls I'd advise considering those devices fully compromised.

[Damien van der Linden @LindenSec]

Something different today, how about a short CTF-styled KQL challenge? Would love to do these on a larger scale, testing the waters here!

https://t.co/C9Fv4DVyFm

[Damien van der Linden @LindenSec]

When I researched the manualfinder/pdf editor malware, there were still open questions so I focused on the detection. This blog from @Truesec clears up a lot with an amazing deep dive. Fantastic work! Must read:

[Mattias Wåhlén 🇪🇺🇺🇦🇨🇦 @WahlenPMattias]

Together with my collegues Nicklas and Oscar at @Truesec, I have posted our findings on TamperedChef and a campaign of malicious apps.

https://t.co/W3wN4rh2yW

[Damien van der Linden @LindenSec]

This is my first blog that surpassed 1k views and skyrocketed my blog. Thanks everyone for reading and using my query! There will be a few confirmed new IOCs added, so make sure to rerun the query later today!

[Damien van der Linden @LindenSec]

Appreciated!✊

[Aura @SecurityAura]

Just added @LindenSec blog to my quick page of Defender Stack and KQL Resources:

https://t.co/nIs0ZVl7Wn

Make sure to go check out his blog! Newest entry is about our current favorite: ManualFinder/PDF Editor! 🔥

https://t.co/sjlqHK3pdq

[Damien van der Linden @LindenSec]

Busy weekend, so was only to able to dive into #NahamCon2025 CTF for the last 3 hours. Glad I still managed to clear some of it!

Some very unique challanges that taught me a lot! Definitely want to finish up some of the more difficult ones I did not have the time for.

[Damien van der Linden @LindenSec]

There we go, received my second "I hacked the dutch government" shirt! Pretty sure a third one is close too 👀

[Damien van der Linden @LindenSec]

Scored another 'I hacked the Dutch government' t-shirt!

Bug bounty programs can be daunting and harsh as it's usually cleared of low-hanging fruit. I always like to step back to a VDP every now and then. Motivates me again!

[Damien van der Linden @LindenSec]

The thing I find often with courses, is that it's a showcase of multiple tools that you can fire on your targets that every other hacker on the program will have done already. And it feels useless, I can use a tool, I need to learn on where to dive deeper, where to move on etc.

[Damien van der Linden @LindenSec]

Since about 2 weeks, I've rediscovered my love for bug bounty hunting. Over the last 2 weeks I have managed to submit 3 valid bugs on VDPs! Yet I feel like I still have a lot to learn when it comes to OWASP Top 10..

Course recommendations are very welcome!

[Damien van der Linden @LindenSec]

I keep on finding the stuff I'm comfortable hunting. Like overprivileged API keys, simple IDOR and information disclosures. It's time to learn to deal with WAF, bypass auth, dust off my XSS knowledge and dive deeper into API hacking.

[Damien van der Linden @LindenSec]

Back in the %1 on @tryhackme! I'm seriously enjoying the SOC Level 1 path, still tools in there I had never used before! Hoping to give the SAL1 cert an attempt when the budget allows it again! (CEH soon first!)

[Damien van der Linden @LindenSec]

With my currently limited and still developing malware analysis skills, I have followed some breadcrumbs of a C2 connection alert. Leading to a SOCGholish infected website, that distributes Lumma malware. Join me on my journey! Feedback is very welcome!

https://t.co/QVKhFn7RYt

[Damien van der Linden @LindenSec]

New post! Unmasking Phishing Hidden in Google Links With KQL, step-by-step query breakdown. https://t.co/kaTvef12YY