10010010

#dfir #malware #threathunting #incidentresponse

[NULL Hyderabad @nullhyd]

#NullHyd August meet

1. Often Missed Critical Vulns by @sarwarjahanm
2. Practical Threat Hunting on K8s Audit Logs by @abhinahii
3. Protecting Business through Third-party Risk mgmt by Khaja Nizamuddin

Thank you @salesforce for hosting us.

@0xmahesh @vhssunny1 @pavanw3b

[David Boyne 🚀 @boyney123]

As you might be aware I'm a huge fan of Amazon EventBridge 😅♥️

Over the past year, I have created some open source projects to help the community extend EventBridge functionality and write tools for development.

Here is a list of tools I have written to help you all 👇🧵

[10010010 @rc_dfir]

@NickSDavis Admin:admin

[10010010 @rc_dfir]

@nixcraft Patch

[Florian Roth ⚡️ @cyb3rops]

Veteran cyber dogs are known for their low tolerance threshold

[marc ochsenmeier @ochsenmeier]

Another update of my slides about #Malware Analysis Fundamentals - Files > Tools #DFIR
https://t.co/b4hYwQ1NZr

[G-TAC Software @gtac_software]

Dumping Active Directory Domain Info - with PowerUpSQL! https://t.co/YF3i5qPpeZ via @rightrelevance thanks @directoryranger

[Florian Roth ⚡️ @cyb3rops]

I've updated my Security Analyst Workshop slides with a few more tools and services

#DFIR #SOC #SIEM #ThreatIntel

https://t.co/KehUlhL2Hy

[SwiftOnSecurity @SwiftOnSecurity]

My Sysmon config sees the shell/open reg key being written, if you want to alert on this. /cc @cyb3rops

[Nicolas Krassas @Dinosn]

GDA Android Reversing Tool - A New Decompiler Written Entirely In C++, So It Does Not Rely On The Java Platform, Which Is Succinct, Portable And Fast, And Supports APK, DEX, ODEX, Oat https://t.co/qpFcnAeG3v

[hashcat @hashcat]

For those of you using a NV GPU with Volta or Turing chipset, listen up! We hacked our way into the post-48k GPU shared memory region. This improved bcrypt cracking performance by an average of 25%. For instance a GTX2080Ti improved from 42116 H/s to 54770 H/s

[0xdf @0xdf_]

RE just retired from @hackthebox_eu. As the creator of the box, I tried to bring phishing/macro obfuscation concepts to the initial access. The intended privescs were the WinRar ACE file exploit, and XXE in Ghidra. I'll show two unintended privescs too.

https://t.co/wy1FNRCBbO

[Arris Huijgen @bitsadmin]

#FakeLogonScreen is a C# utility to steal a user's password using a fake Windows logon screen. This password will then be validated and saved to disk. Useful in combination with #CobaltStrike's execute-assembly command.
https://t.co/o7AH6KBb79

[SANS.edu Internet Storm Center @sans_isc]

Analysis of a triple-encrypted AZORult downloader https://t.co/hhPO97w6z0

[Samir @SBousseaden]

Interesting samples (both signed obfuscated jscripts and drop intermd signed dll, uses couple of lolbins + persistence via UserInitMprLogonScript) ,https://t.co/g2bY52KkFv
https://t.co/yUXVqXyyhm

[Didier Stevens @DidierStevens]

New blog post "Analyzing .DWG Files With Embedded VBA Macros" https://t.co/5o8ICsiMPU

[DirectoryRanger @DirectoryRanger]

Passwordless RDP Session Hijacking Feature All #Windows versions

https://t.co/TlTaQhhny5

[Florian Roth ⚡️ @cyb3rops]

Poor man’s persistent threat detection (medium sized enterprises without SIEM)

A. Check Antivirus logs (best collected in central loc) > search for keywords (see screenshot)
https://t.co/rJvx5fX6z9

B. Run LOKI on exposed or suspiciously behaving systems
https://t.co/VVqnGnteb3

[Nir Yehoshua @niryeho]

Want to classify process injection by Windows API calls? Check out the new poster made by @MalFuzzer and me!
#ProcessInjection #MalwareAnalysis #CheatSheet #Poster
https://t.co/coBtzxZ4nL

[10010010 @rc_dfir]

@0xMatt Hardest part is not to give back who is just blaberring about the incident he has no clue about