Markus Speckmeier

[Markus Speckmeier @msitc]

@blueteamblog Which SIEM do you have experience with?

[James Smith 🇺🇦 @DFIRmadness]

#DFIR Pros, noobs, and #infosec junkies - the final walkthrough necessary to answer all of the big questions surrounding the case of the stolen Szechuan Sauce is complete! Learn how to enrich disk image timelines with events pulled from the memory image!

https://t.co/bBZ6NhEt2W

[Markus Speckmeier @msitc]

MSITC eBook “Windows Defender entfesselt” ab sofort verfügbar https://t.co/6rn1OKqQIv

[Robert Neel @redeemedHacker]

Today: On an endpoint with the most well-known EDR. NtdsAudit.exe blocked. Renamed to pentest.exe, echo 0 >> pentest.exe, pulled back down. No more blocking or alerts.

I guess they haven't seen: https://t.co/JATAclJcfm

Bonus: reversible encryption for the win.

[Markus Speckmeier @msitc]

https://t.co/Ho5i5mKCqE

[abuse.ch @abuse_ch]

https://t.co/b7WQ1Ihzpw: Time to move forward. Your help is needed ⛑️

👉 https://t.co/uy0x9KpZRg

[Florian Roth ⚡️ @cyb3rops]

RedMimicry
Actor Emulation and Breach Simulation Tool
by @ReleasePreview

- a great example of how to do it right
- vetting
- watermarked
- YARA and Sigma rules

https://t.co/Yb6kgEUGct

[RythmStick @_RythmStick]

Been playing with AMSI and C#:
https://t.co/iIjHrz3RRy

[Markus Speckmeier @msitc]

MSITC ist ab sofort offizieller ESET Silver Partner https://t.co/vrV3687Q39

[Markus Speckmeier @msitc]

Homeoffice mit Nextcloud für kleine und mittlere Unternehmen in der Corona-Krise https://t.co/zXTftQvEDv

[michal Naka @michalnaka]

An Italian hospital ran out of ICU valves. A local biz brought a 3D printer to the hospital, redesigned & produced the valves in a few hours.

“At the time of writing, 10 patients are accompanied in breathing by a machine that uses a 3D printed valve.”

https://t.co/HjjdYKZvyS

[Markus Speckmeier @msitc]

Fünf gute Gründe für den Einsatz von Nextcloud in Unternehmen https://t.co/3BmPOTFuF6

[Markus Speckmeier @msitc]

Unterstützung durch MSITC bei der Einrichtung von Nextcloud für KMU und Homeuser https://t.co/m5GknyR2SR

[Markus Speckmeier @msitc]

Nextcloud für kleine und mittlere Unternehmen (KMU) https://t.co/9CElzDhK12

[dylan @_batsec_]

My first blog post! Bypassing AV via in-memory PE execution. I've created a tool to go along with the post and help automate creating undetected PEs, links inside the post 😉 https://t.co/YOhj5XaKtA

[TrustedSec @TrustedSec]

Magic Unicorn 3.8.1 released.

Adds new method for platform detection, obfuscation, and a fix for python2 raw_input when using AMSI bypass.

https://t.co/YeXwYojd5l

#TrustedSec

[Ismael Valenzuela @aboutsecurity]

Minjector & Memhunter: learning code injection techniques and hunting memory resident malware like a boss (aka at scale) by my friend and @McAfee colleague @marcosd4h - https://t.co/PhIKQMjI9T #DFIR #ThreatHunting

[Panos Gkatziroulis 🦄 @ipurple]

Sliver - Implant framework https://t.co/HADXQDau2G