Security Doggo

#infosec #cybersecurity #SIEM #malware #incidentresponse #threathunting #phishing #YARArules I find #APTs, #malware, and #credharvesters 🐕 in a world of 🐟

[Security Doggo @securitydoggo]

UDS 2019 Current Agenda.doc https://t.co/JCGF855ysR Run here: https://t.co/2wCxrIOiZY 443 to photopoststories[.]com #malware #infosec #phishing @James_inthe_box @VK_Intel @MalwareParty @_jsoo_ @ItsReallyNick @Ledtech3

[Security Doggo @securitydoggo]

@SwiftOnSecurity Really sucks if your entry name give away the username (e.g. if you have multiple twitter accounts). Also pre 2019 accounts have their password iterations set to 5k by default but to my knowledge @LastPass never let customers know of the new 100100 iteration max.

[Security Doggo @securitydoggo]

If you ever changed your #LastPass password iterations count, it never got updated when @LastPass changed their default to 100,100 from 5k. Anyone got a calculator to see how long it would take various iteration amounts to crack?

[Security Doggo @securitydoggo]

@cyb3rops Great cheat sheet. Will have to use it to marry it up with the alignment of log sources and log events from clients and see where gaps reside across the base.

[The Hacker News @TheHackersNews]

Stories from the SOC: #Fortinet authentication bypass observed in the wild.

Read: https://t.co/7l1THrLXHA

via @attcyber

[Security Doggo @securitydoggo]

@USCGSoutheast Rest in peace. You will be missed.

[Security Doggo @securitydoggo]

While I never got the opportunity to meet him in person, I have so many fond memories of chatting with him in DMs and seeing his analysis on the random stuff I tag him in. Sad to lose a hero and such an amazing person in the field.

[SentinelOne @SentinelOne]

The SentinelOne team is deeply saddened by the sudden loss of our former teammate, & friend of so many, @VK_Intel. Vitali was a founding member of SentinelLabs & made numerous contributions to the security community. Our thoughts are with his family.

[Security Doggo @securitydoggo]

@bmcder02 @MicrosoftDART Super super great post - I'm also SUPER bummed because this covers everything I wanted to do in a future blog post 🥲

[Blake @bmcder02]

My first blog with @MicrosoftDART!
This is a post incident report, talking about some of the TTPs we saw in a recent ransomware incident. This really emphasizes the importance of doing a post ransomware IR.
https://t.co/NXPOqR5EST

[Security Doggo @securitydoggo]

@tsunami_cyber @avuko @Fortinet @FortiGuardLabs What follow up activity have you observed? The ones we looked into, some are potential FPs for actual admin activity or patching at the time. Still waiting for more responses and info.

[Security Doggo @securitydoggo]

Any one got logs to share regarding CVE-2022-40684? Seeing some activity for the string in the advisory user="Local_Process_Access" - you all seeing these as system config file downloads via report runner? @Fortinet @FortiGuardLabs #CVE202240684 #exploit #cybersecurity #infosec

[Security Doggo @securitydoggo]

@avuko @tsunami_cyber @Fortinet @FortiGuardLabs The "Admin performed an action from GUI" does get forwarded as a system event. No instances of the other log within my sources unfortunately for confirmation.

[Security Doggo @securitydoggo]

@cyb3rops https://t.co/x07epmTMRP Some nice intel and info, but guess it will be more helpful for updates from Fortinet and others.

[Security Doggo @securitydoggo]

Any one got logs to share regarding CVE-2022-40684? Seeing some activity for the string in the advisory user="Local_Process_Access" - you all seeing these as system config file downloads via report runner? @Fortinet @FortiGuardLabs #CVE202240684 #exploit #cybersecurity #infosec

[Security Doggo @securitydoggo]

@cyb3rops We've seen this indicator but there looks to be potentially FP overlaps - definitely need more information.

[Security Doggo @securitydoggo]

Seeing the activity with node.js now, alongside Report Runner

[Security Doggo @securitydoggo]

@GossiTheDog @Fortinet @FortiGuardLabs @Horizon3Attack If I find anything and if I can share, I definitely will. It's going to be a busy day.

[Security Doggo @securitydoggo]

@GossiTheDog @Fortinet @FortiGuardLabs Unfortunately not - I don't believe we receive that level of logging. I haven't had a chance to dig into the logs for these orgs yet.

[Security Doggo @securitydoggo]

@HuntressLabs Was having a discussion about this with some people the other day🙃

[Security Doggo @securitydoggo]

@Securonix Great work by the team! Just a few errors with some of the commands written out, and I think the picture for figure 18 is not right?

[Security Doggo @securitydoggo]

@EKFiddle Seeing these now at godmessagedme[.]com as well. @DreamHost @GodsWhisperCast

[Security Doggo @securitydoggo]

Incredible amount of pages on @issuu with a clickable box/link (usually for click here to access document) to 0365 #credharvesters #infosec https://t.co/APuke00tbx