Rubén Revuelta Briz

DFIR | Threat Hunting | Malware Reversing Cibersecurity enthusiastic.

[msticpy @msticpy]

MSTICPy 2.7.0 release
- 2 new threat intel providers for CrowdSec and AbuseIPDB
- New MS Sentinel and Kusto drivers now the defaults
- Query file editor for MSTICPy template queries
- Azure auth fixes for MicrosoftSentinel

More details https://t.co/M8Tn0QuC8f

[Rubén Revuelta Briz @rubn_RB]

@olafhartong @Cyb3rMonk @falconforceteam @gijs_h Is there any way to automatically deploy uses-cases stored in a git repository to Microsoft Defender 365? I know that it os possible to sentinel. Amazing Job!

[msticpy @msticpy]

MSTICPy release 2.3.1
- Hide progress bar with TILookup
- init_notebook works offline or in air-gapped env
- some important Azure/Sentinel/AzureML fixes
Now on PyPI https://t.co/OHDnrkTl66
Read the goodness in the rel notes: https://t.co/Y2OHFHxDu1
#msticpy #CyberSec #Jupyter

[Rubén Revuelta Briz @rubn_RB]

¿Estás sacando el máximo partido a MITRE ATT&CK?: Análisis de la visibilidad del SOC — Parte I https://t.co/ZGLmGCohbS

#ciberseguridad #mitre #securityoperationscenter

[Rubén Revuelta Briz @rubn_RB]

No hace mucho participé en unos ejercicios en los cuales el equipo de pentesting volcaba la SAM y LSA Secrets de forma remota. Me lo apunté en el TODO con la idea de ver como funcionan dichas técnicas.
#threathunting #Ciberseguridad
https://t.co/9FPn79HiAZ

[inversecos @inversecos]

1\ How to detect what command line spawned a process with no EDR/AV? 👀 #DFIR

If you have a memory sample, this is how you can figure out what cmd spawned the processes by using volshell and memory forensics.

STEP BY STEP GUIDE BELOW

👇 👇 👇 👇 

#MemoryForensics

[Rubén Revuelta Briz @rubn_RB]

User-mode rootkits (II): IAT Hooking + Dll Injection https://t.co/q6e9r5Zf2A

[Ocelotty @Ocelotty6669]

New malware campaign (Guildma/Astaroth?) abusing @Avira executable for infection?🤔
#Malware #threathunting #lolbin @cyb3rops @malwrhunterteam

[Nasreddine Bencherchali @nas_bench]

"Svchost.exe" Mind Map covering its cmdline options, logs and "normal" behavior.

Link: https://t.co/rjijAUU6YH

#Detection #BlueTeam #Windows

[Rubén Revuelta Briz @rubn_RB]

User-mode rootkits (I): Inline Hooking https://t.co/02VN2LRrol

[Rubén Revuelta Briz @rubn_RB]

@elisalem9 Nice thread! Could you share hash sample?

[Alexandre Borges @ale_sp_brazil]

Malware threats have used well-known Windows APIs, which are used for encoding and decoding pointers, so protecting itself against potential hooking.

#malware #reversing #windows #programming

[Mr B0b @_MrB0b]

SilentLsassDump - A new #CobaltStrike Beacon Object Files (BOF) to dump the LSASS process via the Silent Process Exit mechanism using direct syscall generated with @Outflanknl's InlineWhispers
👉 https://t.co/I7eMoxTg4Z
Sources : https://t.co/g44tf49bgF

[Rubén Revuelta Briz @rubn_RB]

@notwhickey Great work! I have tested it and works as you mentioned!

[¬ whickey @notwhickey]

I found a new #lolbin for downloading arbitrary files
`C:\Windows\System32\IME\SHARED\IMEWDBLD.exe <URL>`
Find the downloaded file in `%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>`
#IMEWDBLD #lolbas #InputMethodEditor

[Alex Verboon @alexverboon]

Added another KQL query to identify Exchange servers using Defender for Endpoint TVM inventory data. https://t.co/tSijPcrLY3 # #HAFNIUM #DefenderforEndpoint

[Rubén Revuelta Briz @rubn_RB]

@alexverboon Amazing work! So useful!

[Florian Roth ⚡️ @cyb3rops]

Starting anomaly detection for threat hunting can be frustrating. Users do strange things on their systems. Whatever you can imagine, reality is much worse.

[Check Point Research @_CPResearch_]

We are glad to publish our review of one of the biggest and most interesting malware operations in existence.
How does it work? Who is behind it? Read all about it.
https://t.co/kr298aadHI

[Jonas L @jonasLyk]

Wanna disable Defender when enabled Isolated Core and Tamper protection?

Its a bit more trouble- but doable, without ruining Isolated Core/Secureboot etc.

Defenders process will run as a unkillable protected service- so new tricks needed.

Here we go: