zer0wrinkles

Security is hard.

[Fabian Bader @fabian_bader]

Passkeys + TokenTacticsV2 💖 XDRInternals

Or: How I automated what should not be automated 😂

https://t.co/49WO5gD13y

[zer0wrinkles @zer0wrinkles]

#clickfix
Compromised Host: myasiantv[.]com[.]lv
Injected Javascript: perpetratoralimony[.]com
Malicious Payload: erisaactuarialservices[.]com

2nd Stage:
hxxps://www[.]qacerp[.]com/oapt.wav

SHA1: d9efb40a6400e6fff970e582bf1fa5a36981b254

Saves as file name: 9mx254.ps1

[zer0wrinkles @zer0wrinkles]

A ton of Custom Detection and Threat Hunting content can not be migrated over to IdentityLogonEvents

[zer0wrinkles @zer0wrinkles]

Some of the most important (in my opinion) columns from AADSignInEventsBeta, which aren't provided in IdentityLogonEvents include:

DeviceTrustType, IsManaged, IsCompliant
ConditionalAccessStatus
NetworkLocationDetails
SessionId, CorrelationId
RiskLevelAggregated and RiskDetails

[zer0wrinkles @zer0wrinkles]

So far I've found https://t.co/CUESg1j4zT which has been great

[zer0wrinkles @zer0wrinkles]

Any recommendations for a resource like The DFIR Report that focuses on analysis from Cloud/OSX intrusions?

#DFIR #OSX #CLOUD #IR

[Olaf Hartong @olafhartong]

Working on a new blog in the MDE internals series, should be out tomorrow.
"Microsoft Defender for Endpoint Internals 0x05 — Telemetry for sensitive actions" including a tool drop

[Wes Lambert @therealwlambert]

While I put some stuff together a long time ago, things have changed since the original integration. Would folks be interested in continuing to integrate @securityonion and @limacharlieio?

https://t.co/hTMymQ6QIY
https://t.co/iJxTrl6xUf

#DFIR
#Infosec
#ThreatHunting

[Florian Roth ⚡️ @cyb3rops]

Lol - 4 open source projects and 1 commercial C2 framework

I case you don’t remember: it’s better when it’s open source because everyone can write detections for it and it’ll be less of a threat … oh wait

[vx-underground @vxunderground]

We worked very hard with @SentinelOne to secure and to gift a person a nice prize, a MacBook Pro, for their novel research.

However, based on the lack of material received, in the future we will instead offer a 1-year subscription to Crunchyroll for you dweebs.

[zer0wrinkles @zer0wrinkles]

Is there a way to access the InitiatingProcessParentParent in KQL via DeviceProcessEvents? This entity gets returned when viewing the Device Timeline (detectionDeviceTimeline)

#KQL #MDE #MicrosoftDefender

[zer0wrinkles @zer0wrinkles]

Apparently this will be a feature in a future release next year in Q1-Q2 per Microsoft support

[zer0wrinkles @zer0wrinkles]

Does MDE Advanced Hunting have a way to store "global" functions? Similar to a splunk macro, can I call a "to_timeline" function that has a defined | project format? #kql

[zer0wrinkles @zer0wrinkles]

#GOOTKIT/#GOOTLOADER

Compromised Redirect Host: www[.]premsteingut[.]at
Compromised Payload Host: domainedelaleu[.]com

2nd Stage:
coiffure110[.]com
ventureinn[.]co[.]za
jchavesadvocacia[.]com[.]br

[Josh Trombley @jtrombley90]

#TR aka #TA577 is back after a 3 month vacation. They made some changes to their infrastructure and are no longer delivering #Qbot. Anyone have an idea of what this might be?
https://t.co/x0wEmVnkbq

[zer0wrinkles @zer0wrinkles]

#FAKEUPDATES/#SOCGHOLISH
Source: www[.]boatingbasicsonline[.]com/boat-cleaning-maintenance/

JS payload: Chrome.Update.86a04e.js
C2: 195.189.96[.]41 > fhemahy4[.]push[.]youbyashboutique[.]com

Second Stage CS Beacon: c:\programdata\ntuser.cpl
C2: 84.38.183[.]78 > toppry[.]com

[MalwareHunterTeam @malwrhunterteam]

Interesting signed shellcode loader sample: 91e18e5e048b39dfc8d250ae54471249d59c637e7a85981ab0c81cf5a4b8482d
Checks for CrowdStrike...
🤔
C2: cofeedback[.]com
@VK_Intel @James_inthe_box

[Nazywam @nazywam]

@malwrhunterteam This one's fetched from e0de615d0a78b69b3b81bfac60bf037d (dokumentacja.xls) that is being sent out as DHL malspam. Gets further payload from
https//paste[.]ee/r/zv8f8
https//paste[.]ee/r/A0Ecd

[Jesse Buonanno @1337bananas]

What a great experience to be a part of. MITRE team was awesome, vendors were awesome, learned a bunch!