SmUrF35

[SmUrF35 @smurf3r5]

@splunk @Anomali #MissileMap “Launch Codes Ready — Incoming Bot Missiles” https://t.co/bjox9eRKNG

[SmUrF35 @smurf3r5]

@7og1k @GossiTheDog “I don’t support that”

[SmUrF35 @smurf3r5]

@SwiftOnSecurity @MicrosoftTeams

[SmUrF35 @smurf3r5]

@fouroctets

[Volexity @Volexity]

If you are concerned about a #SolarWinds breach, we have issued guidance on detecting, preventing & remediating the Dark Halo Supply Chain Attack based on our incident response experience dealing with this threat actor. Read more here: https://t.co/kVDw2Etewp #dfir #threatintel

[SmUrF35 @smurf3r5]

https://t.co/JPmj4BORWJ

[RedDrip Team @RedDrip7]

By decoding the #DGA domain names, we discovered nearly a hundred domains suspected to be attacked by #UNC2452 #SolarWinds, including universities, governments and high tech companies such as @Intel and @Cisco. Visit our github project to get the script.

https://t.co/jsnOldynCV

[SmUrF35 @smurf3r5]

@cybercdh What does this malware do when it finds a matched process?

[Katie Nickels @likethecoins]

A few things from the @Volexity blog to highlight - if you're concerned about being impacted by Dark Halo (who used #SolarWindsOrion for access), it's probably worth a look at your Exchange servers. Check for weirdness in \Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth

[Volexity @Volexity]

Supply Chain compromise of #SolarWinds provides Dark Halo actor with unauthorized remote access to select targets. @Volexity has also observed this group using novel methods to bypass 2FA. New research just posted to our blog: https://t.co/qAuOPRJo1o #threatintel #dfir #infosec

[SmUrF35 @smurf3r5]

@Angry_Staffer At what point is it considered an act of war

[SmUrF35 @smurf3r5]

@SwiftOnSecurity

[Metasploit Project @metasploit]

Today we released a community-developed exploit module PR for #BlueKeep (CVE-2019-0708). We expect to continue refining the exploit over time in collaboration with contributors. Some important notes on exploitation and detection from @busterbcook: https://t.co/1y4TodHDc0

[Simone Margaritelli @evilsocket]

Pwnagotchi progress and better demo, waking up, doing recon (napping) sending an association frame (for PMKID grabbing), deauthing a couple of stations and capturing an handshake. RaspberryPi0w + ePaper display + nexmon + bettercap + Pwnagotchi software itself. #hacktheplanet

[Emad Shanab - أبو عبد الله @Alra3ees]

Compilation of commands, tips and scripts that helped me throughout Vulnhub, Hackthebox, OSCP and real scenarios. https://t.co/pTnf6GDUaS

[n00py @n00py1]

Catching up on Derbycon 2018 videos. Anybody have a favorite? Preferably ones that have tool drops? My favorite so far:

“The MS Office Magic Show”

https://t.co/LYAnZfCHp1

[Dan @ragnar_sec]

#pentest #redteam

[SmUrF35 @smurf3r5]

Operating Offensively Against Sysmon https://t.co/BA9RBHDPSy

[Stan Hegt @StanHacked]

A preview for our @DerbyCon presentation titled "The MS Office magic show" next Sunday at 1PM. Here's a blog post on abusing Excel 4.0 XLM macros. Shellcode injection via Win32 API without AV detection, circumventing AMSI and no VBA. It's 1992 again! https://t.co/IPPr360y8B

[Heike Ritter @HeikeRitter]

Now that #MSIgnite is over, it's time to watch some recordings! Here my list of all Windows Defender ATP related sessions:
https://t.co/R0StZDrowh
#wdatp #infosec #cybersecurity

[Vincent Le Toux (Paris, France) @mysmartlogon]

Surprise:
PingCastle open sourced under Non-Profit OSL license!
https://t.co/foeNl5Pswh
A new shiny website:
https://t.co/1LohzHn8Hb

Want to send your feedback or comments in person? Meet me at @DerbyCon (Louisville) or at @Les_Assises (Monaco) or at @BlackHatEvents (London)