Qazeer @_Qazeer

qazeer.io Joined November 2020

Tweets

16
Followers

229
Following

145
Likes

309

Renzon @r3nzsec

10 months ago

I recently co-authored a @Unit42_Intel blog about a unique IR case in which a threat actor’s custom EDR bypass (using #BYOVD) exposed their toolkit, methods, and even identity. Check out how we unmasked them through an opsec slip-up! #dfir unit42.paloaltonetworks.com/edr-bypass-ext…

6 63 222 29K 104

Invictus Incident Response @InvictusIR

a year ago

What a glorious day for Incident Responders around the world! Premium audit events in Microsoft 365 are now available to non-premium users. 🚨Action for you: - Check your mailbox audit settings, details in the blog: techcommunity.microsoft.com/t5/security-co…

3 37 99 9K 39

Download Image

Maxime Meignan @th3m4ks

2 years ago

How to disable some parts of EDR’s telemetry on Windows 10? Just ask nicely! See riskinsight-wavestone.com/en/2023/10/a-u… for more info about an interesting logic bug we found on Win10 that affects all EDRs 😉

2 118 308 48K 130

Gabriel Landau @GabrielLandau

2 years ago

Forget vulnerable drivers - Admin is all you need Article 👉 elastic.co/security-labs/… 👇 Demo - enable sound 🔊

13 142 372 96K 119

Download Video

Jean Marsault @iansus

2 years ago

🚩 @wavestoneFR CTF team #YoloSw4g ranks first of 80+ teams at #CyberEx23! 🚩 Thanks @INCIBE and @OEA_Cyber for the organization & challenges! 🚩 Congratz to @_Qazeer @th3m4ks and @meaz0u for the great team we've been for the last 8 hours, now we go to a well-deserved sleep!

3 6 26 3K 0

Download Image

NoLimitSecu @nolimitsecu

3 years ago

#Podcast #Cybersécurité Épisode #387 consacré à l'outil de contournement des EDR, "EDR Sandblast", avec @th3m4ks et @_Qazeer nolimitsecu.fr/edrsandblast/

0 20 23 0 1

Maxime Meignan @th3m4ks

3 years ago

A promise is a promise: the slides from the #DEFCON30 DemoLabs @_Qazeer and I presented about EDRSandblast are uploaded on GitHub (github.com/wavestone-cdt/…), along with the latest version of the tool! Check out the list of new features in the slides, documentation is on its way ;)

0 18 39 0 9

Jean Marsault @iansus

3 years ago

Actually good question, let's start with obviously wrong answers and see where they lead us. A thread 🧵

Steve Syfuhs @SteveSyfuhs

3 years ago

Actually good question, let's start with obviously wrong answers and see where they lead us. A thread 🧵

37 7 45 0 10

3 40 104 0 35

Will Schroeder @harmj0y

3 years ago

Hey, do you like tokens? Have you always wanted to "harvest" tokens for offensive purposes? If so check out my new post posts.specterops.io/koh-the-token-… where I show I can (finally) write a technical post without memes, and then check out the Koh toolset at github.com/GhostPack/Koh

14 259 550 0 124

Arnaud SOULLIÉ @arnaudsoullie

3 years ago

I'm extremely proud to announce @wavestone_ speaking engagements at @BSidesLV @defcon & more, and it doesn't fit in a tweet (far from it, actually), so a 🧵:

3 11 30 0 0

Alice Climent @AliceCliment

3 years ago

You enjoyed the awesome EDRSandblast tool of @th3m4ks and @_Qazeer and want to know more about the vulnerability used in the MSI AfterBurner driver to play in the kernel mode ? Go check the vulnerability analysis done by hfiref0x swapcontext.blogspot.com/2020/01/unwind…

0 2 7 0 4

mpgn @mpgn_x64

4 years ago

🇫🇷🎙️ Nouvel épisode du podcast @hacknspeak avec @th3m4ks & @_Qazeer pour parler de leur outil EDRSandBlast 🚀 Une interview un peu plus technique que d'habitude où l'on parle du fonctionnement d'un EDR et des mécanismes de contournement 🔥 Bonne écoute 🎶anchor.fm/hacknspeak