Ayush Anand @Securityinbits

I tweet about my learning in Malware analysis, Threat Intel, Detection engineer and DFIR journey. Opinions are mine only! securityinbits.com Singapore Joined September 2015

Tweets

500
Followers

1K
Following

279
Likes

776

Ayush Anand @Securityinbits

21 hours ago

Just got my Sigma → Markdown (KQL & Elastic) converter working vibe-coded using Codex CLI - Converts into Markdown (KQL & Lucene) using sigma backends. - Saves them into your Obsidian - easy to search & link. If anyone’s interested, drop me a comment or DM. I might publish…

1 5 12 879 4

Download Image

YungBinary @YungBinary

5 days ago

New malware analysis blog on #DarkCloud, an infostealer written in VB6 + a config extractor and string decryption tool for IDA Pro! esentire.com/blog/eye-of-th…

0 19 50 14K 23

Download Image

Ayush Anand @Securityinbits

2 weeks ago

Seeing AdaptixC2 pop up in real breaches now 🔍Hunting tips for AdaptixC2: • Look for default user-agent • Use YARA rules + config extractor from @Unit42_Intel • Leverage C2 & hash feeds: ThreatFox, MalwareBazaar, @drb_ra Here’s how defenders can spot it fast 👇

2 3 9 458 5

Download Image

Ayush Anand @Securityinbits

6 days ago

Attackers are still dumping LSASS - comsvcs.dll is showing up in real breaches. What's Inside: ✅ Exact cmd ✅Visual Sigma mapping ✅ Microsoft (Kusto) + Splunk queries Thanks to @cyb3rops, @nas_bench & @_swachchhanda_ for the Sigma rules 👇 Full blog link in reply

1 16 39 4K 22

Download Image

Ayush Anand @Securityinbits

7 days ago

LSASS dump via comsvcs.dll is still in play. Recently seen in a ransomware cases Rundll32 calling MiniDump from comsvcs is a big red flag. I tested this in the lab. These 3 Sigma rules fired without fail 👇 Blog with full command and sigma rule links dropping soon..

4 50 179 18K 109

Download Image

Karsten Hahn @struppigel

a week ago

I teach malware analysis. Use this coupon for -40% on the intermediate course MAH4HEDGEHOGS …nalysis-for-hedgehogs.learnworlds.com

0 5 16 2K 6

Ayush Anand @Securityinbits

2 weeks ago

Ever wonder if a malicious process has injected .NET assemblies? Here’s a 2-sec check using System Informer👇 1️⃣Open Process Properties 2️⃣Go to .NET assemblies 3️⃣Options -> Hide native You'll now see the suspicious injected .NET assembly Dump with pe-sieve for triage.