Nef

The cloud is just someone else's computer. I am someone else's computer. I like InfoSec and DFIR stuff.

[St0pp3r @_st0pp3r_]

@NVISOsecurity identified a campaign where #DeerStealer spread via fake Chrome updates on infected sites, using #Telegram to report infections.
Together with @lontze7 and @nef0sf, we took a closer look at how adversaries are abusing Telegram and shared #KQL queries for detection.

[Thomas Roccia 🤘 @fr0gger_]

📢 New Microsoft Threat Report: "ViewState Code Injection Attacks Using Publicly Disclosed https://t.co/QmvUaRN0KZ Machine Keys"

I wanted to understand deeper how works the attack so I created a detailed overview. Hope that helps 🤓

👉 https://t.co/h5BHyR0XI6

[Nef @nef0sf]

@Cyb3rMonk They usually take the vendor's disposition as granted and forget that a database might contain outdated information.

[Nef @nef0sf]

@Cyb3rMonk I personally see analysts struggle to think outside of a single log/alert. For example in an alert of suspicious outbound communication to a weird port, usually they will not consider searching multiple intelligence sources to decide whether the destination is malicious or not

[Nef @nef0sf]

@vxunderground @MalDevAcademy @mrd0x

[Nef @nef0sf]

@IanColdwater Reconnaissance!

[Nef @nef0sf]

@jaredcatkinson For me, on a dataset of 200k events, the per-user service instances represent ~90% of all service creations.

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Since Cobaltstrike v4.9 is leaked and sooner or later it will be exploited, here is the detection for beacon's core. This detection cannot be modified with malleable profiles. EDRs like Crowdstrike/Elastic/MDATP which constantly scan the memory region for known patterns should easily pick this up. FYI, if BRc4 gets leaked, I would do the same for BRc4 too, like I've done in the past. No hard feelings, just helping the community.

https://t.co/vMzjFtzyfb

[Stephan Berger @malmoeb]

Please do the incident response team a favor, and check that the X-Forwarded-For Header is set on all your reverse proxies / load-balancers / etc.

They will thank you later.

[Tanya Janca | Shehackspurple @shehackspurple]

@bettersafetynet Developers call it a workaround.

Security call it an exploit.

[vx-underground @vxunderground]

tl;dr

security through internet speed

[Nef @nef0sf]

@malmoeb Are both of those files enabled by default? Also do they exist for the portable application as well?

[Nef @nef0sf]

@DebugPrivilege This one: https://t.co/fwUPqh86fL

[Jose Manuel Sánchez · Consultor SEO 🚀 @Josemas]

When you're trying to enter the bios menu after booting

[inversecos @inversecos]

When they tell you their name and job and you gotta act surprised because you work in infosec so you already stalked them.. 💀

[Nef @nef0sf]

@Dell iPhone 14

[Jake Williams @MalwareJake]

Single SOC analyst trying to provide full coverage after teammates call in sick on the holiday weekend...

[Florian Roth ⚡️ @cyb3rops]

I wonder how many hours / days / weeks of analyst time was wasted on outdated IOCs, especially IPs that now have completely different owners
#IOCs

[Florian Roth ⚡️ @cyb3rops]

That escalated quickly #Lapsus
#Nvidia #LeakedCertificate

Mimikatz
https://t.co/TrY6vL2mEE

KDU
https://t.co/RDf6bnuArk

[Nef @nef0sf]

@nu11charb I'm interested as well if you're still looking.