Aaron @usrclass

DFIR Stuff Joined July 2018

Tweets

43
Followers

101
Following

513
Likes

71

Corelight @corelight_inc

3 years ago

🧵We are excited to share that @Zeekurity is now a component of @Microsoft @Windows ! An incredible development that truly establishes Zeek as the de facto standard for #networkevidence: corelight.com/company/zeek-n… 1/4

5 130 346 0 54

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

Blog: A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion by William Backhouse ( @Will0x04 ), Michael Mullen ( @DropTheBase64 ) and Nikolaos Pantazopoulos research.nccgroup.com/2022/09/30/a-g…

1 42 89 0 19

Download Image

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

In case you missed it at #BHUSA, check out @tr1ana's Monkey365, a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews research.nccgroup.com/2022/09/07/too…

0 51 104 0 28

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

Blog: Back in Black: Unlocking a LockBit 3.0 Ransomware Attack - explores some of the TTPs employed by a threat actor who were observed deploying LockBit 3.0 ransomware during an incident response engagement - by @rdi_x64 - research.nccgroup.com/2022/08/19/bac…

2 82 186 0 38

Download Image

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

Blog: Top of the Pops - Three common ransomware entry techniques by @MMatthews32

0 7 11 0 1

Download Image

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

Blog: Climbing Mount Everest: Black-Byte Bytes Back? - research.nccgroup.com/2022/07/13/cli… by Michael Mullen and Nikolaos Pantazopoulos

0 25 49 0 6

Download Image

Bert-Jan 🛡️ @BertJanCyber

3 years ago

Are you using any of the Microsoft Security products and/or #Sentinel? Then this thread is for you! The best resources for #KQL Advanced Hunting Queries or Analytics rules in my opinion. #MDE #ThreatHunting #Detection #DFIR

9 96 348 0 182

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

Blog: Metastealer - filling the Racoon void - research.nccgroup.com/2022/05/20/met… by by Peter Gurney

0 24 70 0 17

Download Image

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

Blog: North Korea’s Lazarus - their initial access trade-craft using social media and social engineering by @MMatthews32 and Nikolaos Pantazopoulos - research.nccgroup.com/2022/05/05/nor…

0 38 60 0 10

Download Image

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

Blog: LAPSUS$ - Recent techniques, tactics and procedures - research.nccgroup.com/2022/04/28/lap… - by @davidbrown1982 @MMatthews32 and @_bobbysmalls

0 40 80 0 8

Download Image

NCC Group Research & Technology @NCCGroupInfosec

3 years ago

Blog: Adventures in the land of BumbleBee – a new malicious loader - research.nccgroup.com/2022/04/29/adv… by @Mike_stokkel, Nikolaos Totosis and Nikolaos Pantazopoulos

0 36 69 0 10

Download Image

Aaron @usrclass

4 years ago

Great effort by the team who have been working hard on this one. The detection mentioned is well worth monitoring for.

NCC Group Research & Technology @NCCGroupInfosec

4 years ago

Great effort by the team who have been working hard on this one. The detection mentioned is well worth monitoring for.

0 9 12 0 1

Download Image

0 2 2 0 0

The DFIR Report @TheDFIRReport

4 years ago

Thanks to all the folks in the community doing what you do, we appreciate you: @ankit_anubhav,@likethecoins,@BushidoToken,@James_inthe_box,@ffforward,@0xThiebaut,@MichalKoczwara,@malware_traffic,@Hexacorn,@beardofbinary,@DidierStevens,@MalwareRE,@ForensicITGuy,@Paulsec4

1 5 37 0 0

NCC Group Research & Technology @NCCGroupInfosec

4 years ago

Blog: Log4Shell: Reconnaissance and post exploitation network detection - includes numerous @Suricata_IDS rules and IoCs - research.nccgroup.com/2021/12/12/log…

0 44 115 0 14

NCC Group Research & Technology @NCCGroupInfosec

4 years ago

Blog: Tracking a P2P network related to #TA505 - we've identified a new peer2peer implant capability we attribute to the authors of Grace - research.nccgroup.com/2021/12/01/tra…

1 26 46 0 6

The DFIR Report @TheDFIRReport

4 years ago

Analysis and reporting completed by @Kostastsale, @pigerlin, and @_pete_0 📢Shout-outs to @James_inthe_box, @TheRecord_Media, @malware_traffic, @redcanary, @Hexacorn, @DidierStevens, @nccgroup, @beardofbinary, and @campuscodi.

1 3 10 0 0

NCC Group Research & Technology @NCCGroupInfosec

4 years ago

TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access research.nccgroup.com/2021/11/08/ta5…

0 32 46 0 6

The DFIR Report @TheDFIRReport

4 years ago

Analysis and reporting completed by @Kostastsale Reviewed by @iiamaleks and @pigerlin 📢Shout-outs to @TheRecord_Media, @BHinfoSecurity, @malware_traffic, @NCCGroupInfosec, @redcanary, & @AltShiftPrtScn

1 2 10 0 0

The DFIR Report @TheDFIRReport

4 years ago

BazarLoader and the Conti Leaks Discovery: AdFind, Advanced IP Scanner, PowerSploit, Nltest, Net, etc. Credential Access: ntdsAudit, ntdsutil, LSASS Access Defense Evasion: Process Injection C2: #CobaltStrike, AnyDesk Exfil: Rclone (upload to mega) thedfirreport.com/2021/10/04/baz…