Manivel @manivelc

Security Professional Bengaluru, India Joined June 2009

Tweets

11
Followers

89
Following

585
Likes

7

Samir @SBousseaden

4 years ago

detecting credentials dumping from the registry remotely is as important as detecting other credaccess vectors like lsass mem Another example of advantages of correlating endpoint data (file creation enriched with header-info) with logon data using EQL github.com/elastic/detect…

2 44 130 0 32

Download Image

Justin Elze @HackingLZ

4 years ago

Other day I asked for large repos of detection rules here is the running list of responses. Elastic - github.com/elastic/detect… Sigma - github.com/SigmaHQ/sigma Chronicle - github.com/chronicle/dete… Splunk - research.splunk.com/detections/ Falcon Force -github.com/FalconForceTea…

8 294 825 0 349

inversecos @inversecos

4 years ago

1\ How to prove malicious macro was enabled & clicked? 👀 #DFIR HKEY_LOCAL_MACHINE\USERDAT\Software\Microsoft\Office\<VERS>\<PROGRAM>\Security\Trusted Documents\TrustRecords Look ONLY for values where last four bytes are "FF FF FF 7F". These files had macros enabled 👇👇👇

14 537 2K 0 534

Download Image

Nasreddine Bencherchali @nas_bench

4 years ago

Windows Services (Creation) Mind Map covering service creation and detection methods. Link: github.com/nasbench/MindM… #Detection #BlueTeam #Windows #Services

4 232 630 0 127

Download Image

Andy Robbins @_wald0

4 years ago

I’m a firm believer in the (cliche) adage, “Outcomes, not output.” It’s not about the number of lines of code you wrote in 2021, but the impact those lines of code had - the outcomes they created. Here’s 5 small things you can do in 2022 to create big AD security outcomes:

3 109 318 0 130

Ryan @Haus3c

4 years ago

New blog post on Cobalt Strike and some of the events/logs that built-in commands generate. This isn't meant to be a 'tradecraft 101' for CS, it's meant to show (especially new CS users) what some of the built-in commands look like behind the scenes.| hausec.com/2021/07/26/cob…

7 141 307 0 56

Florian Roth ⚡️ @cyb3rops

4 years ago

The sad truth about work is that 97% of the victims don’t have a blue team, no SIEM, no SOC and don’t monitor Twitter for new threats They have an admin or IT service provider that manages users, mail boxes, installs printers & once in a while a new AV

64 286 1K 0 74

Andrew Oliveau @AndrewOliveau

4 years ago

As some of you may know, #CobaltStrike beacons can be detected using ETW. For CCDC our team built and used BeaconHunter to detect and respond to these threats. Github: github.com/3lp4tr0n/Beaco… We were able to kill +210 beacons (~70% automated) and monitor their behavior like...

7 209 511 0 104

Anton @Antonlovesdnb

6 years ago

A lot of mud slinging on InfoSec twitter lately; I wanted to flip the script a bit and highlight the blogs, tools, talks etc that I keep coming back to on a regular basis, both as a defender and general InfoSec professional. Thread..