0xSe7eN

Threat detected: Virus:PUA/AnalystYXBhcGxpbA
A threat was detected from this account.

Date: 1/7/2022 1:49 PM
Details: This account is infected by Vstai

[SmoothDeploy @SmoothDeploy]

Check out our latest blog post on #SummaryRules and #DataLake in #MicrosoftSentinel.

An introduction on Summary Rules in Microsoft Sentinel on optimizing #SIEM costs without compromising #threatdetection & monitoring capabilities. #detectionengineering

https://t.co/6MygPyaWFd

[NVISO Labs @NVISO_Labs]

Detect #Kerberos ticket abuse fast: convert hex to binary, apply bitwise ops in #KQL, and hunt for unusual TGT flag sets seen in offensive tools. Read @plehdneS latest blog post here 👇https://t.co/yCZxuo3JE6

[NVISO Labs @NVISO_Labs]

Has your company ever been affected by a compromised business email? Read @plehdneS latest blog post, "How to Hunt & Defend Against Business Email Compromise" here 👇
https://t.co/l2B5rCLuxe

[CrackWatch @realCrackWatch]

Rockstar is selling cracked game copies on Steam

[0xSe7eN @plehdneS]

@_st0pp3r_ @NVISOsecurity @BryceGalbraith Congrats mate, more than deserved 💪

[Unit 42 @Unit42_Intel]

2022-10-10 (Monday) - #CobaltStrike from #Qakbot (#Qbot) infection - Cobalt Strike HTTPS server using pigahinilu[.]com on 64.44.102[.]244:443 - IOCs available at: https://t.co/m12p9uqQBb

[Joe Stocker @ITguySoCal]

Microsoft Defender has been updated to block 15 different methods of LSASS dumping @msftsecurity @AV_Comparatives
https://t.co/nigMkDfS3c

[Doug Bienstock @doughsec]

Dropping some 🔥APT29 observables this afternoon. Updates to our AADInvestigator and white paper too!
https://t.co/2He0cArioL APT29 continues to up their opsec game 🥷 targeting #Microsoft365 #DFIR

[proxylife @pr0xylife]

#Qakbot - obama200 - html > .zip > .iso > .lnk > calc.exe > .dll > .dll

T1574 - DLL Search Order Hijacking

cmd.exe /q /c calc.exe

regsvr32 /s C:\Users\User\AppData\Local\Temp\WindowsCodecs.dll

regsvr32.exe 102755.dll

https://t.co/2Vgg6cuRFh

IOC's
https://t.co/e7hkNW8eQu

[proxylife @pr0xylife]

#Qakbot - obama199 - .html > .zip > .iso > .lnk > .dll

#Signed - TOPFLIGHT GROUP LIMITED

%WINDIR%\System32\regsvr32.exe data\assets\images\xtcy.dat

https://t.co/7v95wn6v69

https://t.co/uL0Beu0bHp

Nice find @k3dg3! 🔥

IOC's
https://t.co/N6OdcyMmy2

[ςεяβεяμs - мαℓωαяε яεsεαяςнεя & мαℓωαяε gεиεтιςιѕт @c3rb3ru5d3d53c]

Destroying #Bitter #APT's #ZxxZ #Backdoor

✅ #Exploit+#Shellcode Analysis
✅ Building it's C2 Server to Execute a #Meterpreter Payload
✅ YARA/Suricata/Sigma
✅ #Ghidra Project
✅ #Malware Reverse Engineering
✅ Config Extraction

https://t.co/1nNAHMattv
https://t.co/rb0FuxB1HR

[IAM!ERICA @EricaZelic]

New UAC bypass credited to @filip_dragovic
https://t.co/yVo7xnbWJj