🦥Prasanth 👽

Cyber Security Analyst

[🦥Prasanth 👽 @mgprasanth]

Rapid Windows IR just got simpler.🔥

Introducing NovaTrace IR Kit – a single-file PowerShell collector that pulls 50+ key artifacts into one clean ZIP.

No installation required. No dependencies. Useful for Rapid Incident Response.

Collect data directly through PowerShell or remotely via Defender Live Response.

If you're on the front lines of incident response, this one’s worth checking out https://t.co/Jf4UVUpEfu

#DFIR #IncidentResponse #BlueTeam #CyberSecurity #PowerShell #Rapid #incidentresponse

[🦥Prasanth 👽 @mgprasanth]

#SilverFox #ValleyRAT

https://t.co/YP3gQ058RX

[🦥Prasanth 👽 @mgprasanth]

@ExpelSecurity Hi,

Thank you for providing additional context on this campaign. I’ve also found some resources and am sharing them here for your reference.

https://t.co/B6RwZUQgzJ

[🦥Prasanth 👽 @mgprasanth]

@HuntYethHounds @luke92881 @struppigel @secbadger_ @StefC1993 Has anyone happened to see the full attack chain so far?

[mRr3b00t @UK_Daniel_Card]

Hey this is a cool site:

https://t.co/ylaCDWhMCA

#TOR

[🦥Prasanth 👽 @mgprasanth]

A Security Analyst’s Guide to #Security Identifiers (#SIDs)

https://t.co/PjYGdNlMmc

[🦥Prasanth 👽 @mgprasanth]

The Silent Threat: An Analysis of #SVG-Based #Phishing Attacks

https://t.co/um5XBdpMFW

[Shodan @shodanhq]

$5 Membership sale is live for the next 24 hours: https://t.co/0iqiq2vlzP

[🦥Prasanth 👽 @mgprasanth]

🛡️Active Directory Hardening for Enterprise Security by Tahir https://t.co/NKeJ3Q5weP

[🦥Prasanth 👽 @mgprasanth]

The Shadow in the Stream: Hunting Adversary-in-the-Middle Phishing Attacks with KQL https://t.co/5InzJQXhzg

[🦥Prasanth 👽 @mgprasanth]

Vidar’s Game: Infostealer in a Music App Costume with Lumma’s Touch https://t.co/Zvmvyg81yg

[🦥Prasanth 👽 @mgprasanth]

What You Need to Know About the “ToolShell”(SharePoint) Vulnerability

#ToolShell #SharePoint

https://t.co/DnlWwQ5etx

[ELON CLIPS @ElonClipsX]

Elon Musk: AI is like a genius child. You want it to grow up with love of the truth and of humanity.

“I do worry about AI. Because we are creating an intelligence that ultimately will be far more intelligent than any human, and ultimately more intelligent than the sum of all humans.

In creating AI, we need to be very careful. It's like having a genius child. You want to have that child grow up with good values.

The most important thing in training AI is that it's rigorously truthful. This is very, very important. Essential.

My concern about a lot of the AIs that are being developed is that they're trained to lie. In some cases, with potentially disastrous consequences.

When Google Gemini came out, people asked, which is worse, misgendering Caitlyn Jenner or global thermonuclear war? And it said, misgendering Caitlyn Jenner. That's a problem, guys.

If this AI becomes super powerful, it could decide that the best way to avoid misgendering is to kill all humans, which makes the probability of misgendering zero.

It's very important to have AI be maximally truthful and curious, and love humanity. Very important.”

Harrisburg, Pennsylvania, October 19, 2024

[Red Canary, a Zscaler company @redcanary]

NEW: Google Chrome's new application-bound encryption has shifted the stealer landscape, forcing malware authors to implement new features to bypass the control and steal cookies. https://t.co/AHsvhwNlt7

[🦥Prasanth 👽 @mgprasanth]

@elonmusk @cb_doge But it's a large step for the mankind!

[Hunter @HunterMapping]

🚨Alert🚨CVE-2024-28995: High-Severity Directory Traversal Vulnerability affecting SolarWinds Serv-U.
🔥Deep Dive from @rapid7: https://t.co/DGGKIk7QGF
⚠SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
📊328.5K+ Services are found on https://t.co/g3tSyh1Boc
🔗Hunter Link:https://t.co/5yQlTLhUJ0
👇Query
Hunter: protocol.banner="Serv-U FTP"
FOFA: app="SolarWinds-Serv-U-FTP"
SHODAN: product:"Serv-U ftpd"
#SolarWinds #hunterhow #infosec #infosecurity #Infosys #Vulnerability

[Germán Fernández @1ZRR4H]

📌 Robo y venta masiva de datos de Banco Santander y Ticketmaster se debe al acceso no autorizado a servidores del proveedor Snowflake.

[+] https://t.co/EyhW5Suc1d #SupplyChainAttacks ⚠

El acceso inicial se logró a través de credenciales comprometidas vía #LummaStealer.

[R. @0xrb]

🚨 Alert! Another 𝗔𝗰𝘁𝗶𝘃𝗲 #SystemBC #Malware spreading from ATOMIC-NETWORKS-1,(AS399820) Netherlands (NL).

C2 IP:
204.137.14.135[:]443

Malware Hash:
995710596451478545b9113bfd75a219

23 Victims Confirmed 👇
Be on guard! 🛡️ #threatintel

[Andrew Chiles @AndrewChiles]

All slides for presentations at #SOCON2024 sponsored by @SpecterOps are now live! https://t.co/Zbt0XGMu6o

[Germán Fernández @1ZRR4H]

🎯 Hunting #Grandoreiro Infrastructure (1st stage):

▪ Shodan: http.html_hash:1528083672 port:443 org:"Microsoft Corporation'"
▪ Censys: services.http.response.body_hash="sha1:b6306fe94c164053882259f3d3105e6c4519bf81" and services.port=`443` and autonomous_system.name=`MICROSOFT-CORP-MSN-AS-BLOCK`

Current servers and domains:
- 74.242.169.21 chwzfacservconsudigitales[.]switzerlandnorth[.]cloudapp[.]azure[.]com
- 20.150.223.142 lvetfacdigitalservconsultibsc[.]westus3[.]cloudapp[.]azure[.]com
- 20.70.209.159 tocmacipd[.]australiaeast[.]cloudapp[.]azure[.]com
- 20.240.184.172 yunfacdigitalservconsultbls[.]swedencentral[.]cloudapp[.]azure[.]com
- 4.223.67.111 upohfacdigitalservconsultiyun[.]swedencentral[.]cloudapp[.]azure[.]com
- 4.232.161.177 buzntribtacion[.]italynorth[.]cloudapp[.]azure[.]com
- 20.172.67.43 eyedocservicioconserfec[.]westus3[.]cloudapp[.]azure[.]com
- 74.241.129.65 sycleanservicioconsultc[.]swedencentral[.]cloudapp[.]azure[.]com
- 20.240.202.146 wattservicioconsulcroncl[.]swedencentral[.]cloudapp[.]azure[.]com
- 20.118.189.104 efacdigitalservonsultcris[.]westus3[.]cloudapp[.]azure[.]com
- 20.168.11.2 sycleanservicioconsultcon[.]westus3[.]cloudapp[.]azure[.]com
- 20.38.35.121 stoconecservstalcloudytz[.]westus3[.]cloudapp[.]azure[.]com
- 20.168.104.96 afipconsudeclaracioncontrib[.]westus3[.]cloudapp[.]azure[.]com