Threat Hunting

Open to negotiate for threat hunting and threat analysis remote services

[Threat Hunting @Mahdi_htm]

🎯 New report: Battle of the Shadows: APT Wars in C2 Takeovers & Payload Verification

Uncover how elite APTs:
🔹 Defend their C2 infrastructure
🔹 Verify payloads to avoid takeovers
🔹 Engage in tactical "shadow wars"

https://t.co/2S7KkdVguB
#threatintelligence

[Threat Hunting @Mahdi_htm]

How do you know this is Chinese? Just because of aliexpress?

[Threat Hunting @Mahdi_htm]

@cyb3rops

[Threat Hunting @Mahdi_htm]

It seems like the Fortinet team is under heavy pressure as they’ve released a list of attacker IPs. However, I advise against blindly blocking these IPs. They might belong to CDNs or could have already been reassigned to legitimate services. Always verify before taking action.

[Threat Hunting @Mahdi_htm]

🚨 After seeing the Snake driver sniff inbound traffic from a mail server using an incredible technique, now we encounter something new: a Linux kernel module that hijacks inbound network traffic to compromised systems.

Innovation in attack vectors is relentless.

[Threat Hunting @Mahdi_htm]

Whenever you encounter a combination of interviews, video calls, and macOS, you might be targeted by a Lazarus campaign!

[neeraj @knight0x07]

Initial infection chain of the new #Lazarus Willo Video Interview campaign is outlined in detail within the infographic

Releasing an in-depth blog abt the campaign soon. Happy New Year!

@banthisguy9349

#cyber #dfir #infosec #cybersecurity #malware #threatintel #cti #dprk #apt

[Threat Hunting @Mahdi_htm]

Does anyone know which threat actor is attributed to stealing IIS machine keys for persistence (executing commands on a web server remotely through IIS insecure serialization)?
#threatintel

[Threat Hunting @Mahdi_htm]

Security vendors with remote command capabilities could be a potential source of lateral movement and command execution.

[blackorbird @blackorbird]

Malware download and use of the Wazuh SIEM agent for remote access and telemetry harvesting.
"remote_commands" option
https://t.co/Icb45EjDAh
ref:
https://t.co/Z5VGrUrDe6

[Threat Hunting @Mahdi_htm]

APT29 and APT28 separately targeted diplomatic entities within a year using decoy and phishing tactics, including a car sale lure. Each group employed distinct methods, such as hosting payloads on public services like webhook.
#threatintelligence
Thanks Unit42

[Threat Hunting @Mahdi_htm]

@rosyna You are right!

[Threat Hunting @Mahdi_htm]

CHM files are being used for Initial Access (Phish-to-Persist), particularly by DPRK-attributed threat actors and more recently in cybercrime operations.

#threatintelligence #threathunting

[Threat Hunting @Mahdi_htm]

F5 The Perfect Place to Hide
China Threat Group Abuses F5 Load for Persistence. The investigation confirmed that the threat actor maintained a presence in the organizations on-premise network for about three years. The overall goal to the target network for espionage.
SygniaTeam

[Threat Hunting @Mahdi_htm]

Enterprise Threat Hunting to catch and follow Lazarus recent campaign with passive DNS.
Validin provides extensive passive DNS records, which map domains to their associated IP addresses over time. This allows analysts to see where a domain has been hosted and track any changes.

[Threat Hunting @Mahdi_htm]

1) Great talk in Positive hack days about OPSEC mistakes, challenges and techniques for my dear partnerships from positive technologies. I have talked about various Threat Intelligence tips and tricks and OPSEC mistakes like NOBUS WebShell, Operations Security (OPSEC),

[Florian Roth ⚡️ @cyb3rops]

You can either hunt for it or check and apply our Sigma rules

If you're unsure whether a detection idea is already covered by an existing rule, you can use the https://t.co/OnIQos7jOe, which was developed by my team member @ph_t__

We've also integrated the API of that service into the Sigma VSCode extension

[Threat Hunting @Mahdi_htm]

Initial Access with Compiled HTML File (CHM) have been used by different TAs including APT37 and APT41.

For hunting/detecting them you should check hh.exe spawning mshta.exe or any other related LOBINs in Event ID 1 of Sysmon or 4688

See the execution flow in the following pics

[Threat Hunting @Mahdi_htm]

APT28 has been targeting Iranian Embassy in Albania with the Browser In The Browser (BITB) phishing technique. Kudos to @_CERT_UA for first discovering this.

[Threat Hunting @Mahdi_htm]

3/3 Do you want to see what attackers did with powershell in your environment? Enable script block logging (EID = 4104 in Microsoft-Windows-PowerShell/Operational) and look for keywords like add-type, net.webclient and CreateThread/CreateRemoteThread and also Sysmon (EID = 3)

[Threat Hunting @Mahdi_htm]

1/3 #APT37 recent sample with OneDrive C2 communications and PowerShell script block with internal create thread
#threathunting

[Threat Hunting @Mahdi_htm]

2/3 Do not forget about PS script block logging and look for suspicious connections to cloud providers like OneDrive. To enable PS script block logging:

HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
$Name = "EnableScriptBlockLogging"
Value:1