NateO

Security things

[Karsten Hahn @struppigel]

New article: "The real reason why malware detection is hard—and underestimated"

If you think an AI with a 98% malware detection rate and 1% false positive rate is splendid, this might change your mind.

#GDATATechblog @GDATA
https://t.co/6anvSxTQo0

[Mandiant (part of Google Cloud) @Mandiant]

We have developed and launched The Mandiant Cyber Threat Intelligence Analyst Core Competencies Framework to help grow the pool of highly capable CTI practitioners. Read this blog post by @_John_Doyle to learn more. 👇 https://t.co/M0Sa9X3XDD

[Ryan Campbell @sec_soup]

New week, new #infosec list 🙌
#DFIR #ThreatIntelligence #malware
https://t.co/KU3Dz3TAV9

[Techmeme @Techmeme]

Researchers detail a malicious campaign that used Windows event logs to store malware, a technique that has not been previously documented publicly in attacks (@ionut_ilascu / BleepingComputer)

https://t.co/HysdupI4jR
https://t.co/ardVe2aEpI

[Botconf @Botconf]

21 videos from #Botconf2022 have been released https://t.co/EvdxwlsA9o

[Tornado @0xtornado]

Watch out for #BumbleBee! 🐝

Here is everything you need to know about this new malware loader ⬇️ 🧵

[Tornado @0xtornado]

An excellent step by step reverse engineering analysis of #BumbleBee from @elisalem9 https://t.co/LQZiup6jMD

[𝔅͛𝔯͛𝔦͛𝔞͛𝔫͛ ͛𝔚͛𝔥͛𝔢͛𝔩͛𝔱͛𝔬͛𝔫͛ @brianwhelton]

This was on a LinkedIn post, the person found it on the internet so no idea who did it.
The cloud services offered and their equivalents from the other venders.

[Mandiant (part of Google Cloud) @Mandiant]

Our experts have gathered sufficient evidence to assess that the activity tracked as #UNC2452, the group name used to track the #SolarWinds compromise in December 2020, is attributable to #APT29.

Learn more: https://t.co/sDoHit8BoN

[Max_Malyutin @Max_Mal_]

#DFIR and #ThreatIntel report ❗️

#Bumblebee new loader campaign Initial Access, TTPs & IOCs, and binary analysis

ZIP > ISO > LNK > Rundll32 > #CobaltStrike

https://t.co/z8TeC6xOwz

[BleepingComputer @BleepinComputer]

New Black Basta ransomware springs into action with a dozen breaches - @LawrenceAbrams
https://t.co/ZrfowdsQci

[Homeland Security @DHSgov]

NEW: @SecMayorkas announces new members of the Homeland Security Advisory Council

Read more about the new members of the #HSAC ⬇️
https://t.co/wh8EInYFxE

[SANS.edu Internet Storm Center @sans_isc]

ISC diary: @malware_traffic reviews change in SMTP data exfiltation by #AgentTesla malware https://t.co/fsiXwpWIQQ

[NateO @NateOSec]

No response, that's disapointing. When you buy a couch, you assume you are going to get the full product. @structube

[NateO @NateOSec]

@structube sectional I bought (which is great) came with a missing end piece. Customer service refuses to swap the single incorrect item, wants us to take the whole couch back. What gives?

[NateO @NateOSec]

@structube any input here? Not sure how it makes sense to take the whole couch back when we just need to swap an individual piece.

[𝔼𝕝 𝕃𝕖𝕠𝕟 ℂ𝕒𝕖𝕤𝕒𝕣 @el_leon_cesar]

CVE-2018-8373 exploit (Internet Explorer Memory Corruption Vulnerability)

https://t.co/wZSsdMb76c

[Karsten Hahn @struppigel]

New Blog Article: Interpreting Antivirus Detection Names. #MalwareAnalysisForHedgehogs 🦔

Thanks to @k_sec and @fwosar for additional information that I added to this article. @hexwaxwing You wanted this. 🙂

https://t.co/k4Meqjgjg2

[operations6 @_operations6_]

#cve-2018-0802 samples from today. Monday should be fun!! 90d66acebfef204bbc908ce877f6d97e97e4cc4e
d1d69f9bd8b9df58628987be6935d6c9cf123112
1828d20efe81bea7b99b7e1a29921fbb47ebfc18
90d66acebfef204bbc908ce877f6d97e97e4cc4e
97ae2230b637f61ba2c8868e2d818526248e8eed

[Karsten Hahn @struppigel]

Some arbitrary facts about malware detection names and detection rates on VT.
(thread)