Censored

[OccupytheWeb @three_cube]

Chinese Hackers Have Taken Up Residency in our mobile networks!

Learn how they do it!

https://t.co/oCT6V8rEzF

[Nathan McNulty @NathanMcNulty]

In case anyone is interested, here's a script to gather Defender logs and create a performance recording, then compress it and upload it to Azure blob storage

This works via Live Response, Intune scripts, etc. Just need Create permissions on a SAS token.

https://t.co/eaSdGYjNQO

[Speaker 25 @rodtrent]

Introducing SOC Optimization Recommendations Based on Similar Organizations https://t.co/WQ2POpA3sQ

#MicrosoftSentinel #Cybersecurity #MicrosoftSecurity #Security #DefenderXDR

[DEF CON @defcon]

DEF CON 33 CTF Qualifcations have a date!

Packet sorcerers, make room in your calendar for the official qualifier event for #defcon 33 CTF! Our esteemed colleagues at the Nautilus Institute are hard at work building the challenges - can you afford to do less?

Further information available at https://t.co/1Nh1Us4k2j. The long season of preparation begins.

[nyxgeek @nyxgeek]

A year ago I spoke at DEF CON 31 about massive user enumeration in Azure. At the time, I had enumerated 24 million users via OneDrive.

Fast forward, and I've now enumerated over 44 million users.

The issues I spoke to in that talk haven't gone away. I know there have been flashier findings in the time since, but user enumeration is a foundational flaw that enables password sprays and phishing attacks against users (the hardest component to "patch").

You can find my slide deck here: https://t.co/0miNCaUgJX

And the YouTube from DC31 here: https://t.co/LJSuIBzPtB

[HoodFamousTV @HoodFamousTV_]

Watching the Uncs playing spades is better than TV😂😂😭😭😂😂😂��

[Nathan McNulty @NathanMcNulty]

Reminder - make sure Device discovery is set to 'standard discovery' or you will not get Automatic attack disruption in Defender XDR

If you don't like the scanning traffic or devices it adds to MDE, use monitored networks or exclusions instead

[Censored @slientTormenter]

@DrippingSecrts @ThatDamnShawn1 Yes! All of you 😍

[Cyber Advising @cyber_advising]

CVE-2023-4966: Citrix Bleed: Leaking Session Tokens

PoC
https://t.co/6ciNM2RvDK

https://t.co/ANJt4bF2TW

[Cyber Advising @cyber_advising]

CVE-2023-36745: Microsoft Exchange Server Remote Code Execution Vulnerability.

PoC
https://t.co/t7kkChV08Z

[Censored @slientTormenter]

@HBCUfessions Throw some D's on her

[Kijo Ninja @kj_ninja25]

XDR, Microsoft 365 Defender Blog Part1 🎉🎉🎉
So excited to share the blog - Summarized the amazing features in Microsoft 365 Defender, XDR ⁉

✅ XDR Blog : https://t.co/SFmf3r0uSW

#XDR #M365D #EDR #MDE #Microsoft365Dfender #KQL #Kusto

[rootsecdev @rootsecdev]

Super awesome watching our targeted ops team showing off C2 operations with sliver at BlackHat. It’s one of my favorite C2’s. Wrote a special blog on hacking an AD environment with it. Enjoy.

“Hacking Active Directory with Sliver C2” by Root ♊
https://t.co/3adh4Q3KIi

[Elli @ellishlomo]

Analyzing security data by joining recent malicious SHA256 hashes from external data with specific tables. Filtering and extracting key fields to detect potential threats.

let SHA256_Abuse = (externaldata(sha256_hash: string)
[@"https://externaldta.txt/"]
with (format="txt"))
| where sha256_hash !startswith "#"
| project sha256_hash;
SHA256_Abuse
| join (union DeviceEvents, DeviceFileEvents, EmailAttachmentInfo
| where TimeGenerated > ago(15d)
) on $left.sha256_hash == $right.SHA256

#ThreatDetection #kql

[Thorsten E. @endi24]

365Inspect
A PowerShell script that automates the security assessment of Microsoft Office 365 environments. https://t.co/mAjB8uiI7S

[Ryan Shead @RyanShead]

Whoever lost their job for this, thank you! 🤣
https://t.co/T2bIF6y6Cf

[Ru Campbell @rucam365]

Defender for Cloud Apps and Sentinel should 100% add this as an OOTB detection if they don’t already.

[Avigayil Mechtinger @AbbyMCH]

Can 9 lines of Python make history in cloud security?

We believe that #PyLoose is the first publicly documented Python-based #fileless attack targeting cloud workloads in the wild.

Read more about it 👇
https://t.co/w4YohVXG6Q

@oren1ofer @TrustingTrust

[SECUINFRA FALCON TEAM @SI_FalconTeam]

Yesterday Microsoft released an advisory about #CVE_2023_36884 and the #Storm_0978 Threat Actor. In today's thread we would like to focus on the Office document Phishing lure and the new Ransomware variant that is associated with the same group.
1/10🧵

[Elli @ellishlomo]

Detects suspicious child processes of a ClickOnce deployment application

SecurityEvent
| where EventID == 4688
| where (ParentProcessName contains @'\AppData\Local\Apps\2.0\'
and (NewProcessName endswith @'\calc.exe' or NewProcessName endswith @'\cmd.exe' or NewProcessName endswith @'\cscript.exe' or
NewProcessName endswith @'\explorer.exe' or NewProcessName endswith @'\mshta.exe' or NewProcessName endswith @'\net.exe' or
NewProcessName endswith @'\net1.exe' or NewProcessName endswith @'\nltest.exe' or NewProcessName endswith @'\notepad.exe' or
NewProcessName endswith @'\powershell.exe' or NewProcessName endswith @'\pwsh.exe' or NewProcessName endswith @'\reg.exe' or
NewProcessName endswith @'\regsvr32.exe' or NewProcessName endswith @'\rundll32.exe' or NewProcessName endswith @'\schtasks.exe' or
NewProcessName endswith @'\werfault.exe' or NewProcessName endswith @'\wscript.exe'))

https://t.co/xxwkbwUcHi

#kql #hunting