Samir

@SBousseaden

Security Researcher Detection Engineering & Threat Hunting

github.com/sbousseaden
Vrijeme pridruživanja: siječanj 2013.
229 fotografija ili videozapisa Fotografije i videozapisi

Tweetovi

Blokirali ste korisnika/cu @SBousseaden

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @SBousseaden

  1. prije 6 sati

    some exploits tend to load directly ntoskrnl.exe (indows Kernel) to do some offsets calcs for some critical kernel structs or global vars ... in normal condition this should be rare so won't harm to add it to your sysmon/EDR config.

    29 proslijeđenih tweetova 71 korisnik označava da mu se sviđa
    Poništi
  2. 3. velj

    high likely fake sample detected: macro code in this doc is similar to the one reported below used to exec hermes ransomware :)

    6 proslijeđenih tweetova 18 korisnika označava da im se sviđa
    Poništi
  3. proslijedio/la je Tweet
    3. velj

    Getting DNS Client Cached Entries with CIM/WMI

    52 proslijeđena tweeta 110 korisnika označava da im se sviđa
    Poništi
  4. 30. sij

    in-memory traces of ppldump, exploiting zam64.sys vulndriver to dump lsass memory, cool stuff. sysmon will show a generic\noisy calltrace so detection chances here are low, if combined with lsass loading dbgcore.dll it may work.

    62 proslijeđena tweeta 154 korisnika označavaju da im se sviđa
    Poništi
  5. 29. sij

    some notes/inputs to take into consideration while investigating persistence via service (hijack existing or/and add new rogue svchost hosted service)

    10 proslijeđenih tweetova 48 korisnika označava da im se sviđa
    Poništi
  6. 29. sij

    Local Groups Discovery: those are the top observed system processes that do some sort of local groups membership discovery (source: eventid 4799), if you see for instance rundll32 in there that something worth further checks (e.g. cmdline, netcons etc.)

    25 proslijeđenih tweetova 61 korisnik označava da mu se sviđa
    Poništi
  7. 28. sij

    simple yara rule to detect suspicious windows servicedll, e.g. 2nd match is related to APT sample "mshlpsrvc.dll"

    20 proslijeđenih tweetova 111 korisnika označava da im se sviđa
    Poništi
  8. proslijedio/la je Tweet
    27. sij

    Windows Kernel _IMAGE_DOS_HEADER::e_lfanew Denial Of Service/Memory Corruption

    69 proslijeđenih tweetova 114 korisnika označava da im se sviđa
    Poništi
  9. proslijedio/la je Tweet
    28. sij

    For today "side lolbin" let's say thanks to: ZOHO Corporation private Limited with their dctask64.exe. Keep injecting all the dll we want with: dctask64.exe injectDll <dllpath> <PID> bonus point: we have the outputs!!! cc

    7 replies 78 proslijeđenih tweetova 174 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  10. 27. sij

    another macro with safe landing (no susp child processes): c2: ssl.securelogonweb\.com, backdoor: cobaltstrike, persis:startupfolder, other:cactustorch, wmic+xsl

    22 proslijeđena tweeta 69 korisnika označava da im se sviđa
    Poništi
  11. 27. sij

    for espionage based attacks, "high" # of copying data from usb to a tmp staging c:\ folder is expected, other than monitoring cmd.exe's cmdline "*copy*e|f|g:*.pdf|.doc|etc.. .*c:\*" any other ideas?

    6 replies 8 proslijeđenih tweetova 72 korisnika označavaju da im se sviđa
    Poništi
  12. 26. sij

    finally a macro sample using something other than ps as a wmiprvse child process :)

    55 proslijeđenih tweetova 140 korisnika označava da im se sviđa
    Poništi
  13. 26. sij

    interesting sample using "over-sizing" likely to bypass AV scan, md5: 15af764731c257caf1ee26d1cfc049a9

    11 proslijeđenih tweetova 51 korisnik označava da mu se sviđa
    Poništi
  14. 23. sij

    interesting sample, using minimal macro to write to startup folder for persistence & uses IE via COM to download 2 txt files (no noisy ps or abnormal exec).

    39 proslijeđenih tweetova 126 korisnika označava da im se sviđa
    Poništi
  15. 23. sij

    behavior detection won the race :)

    5 replies 21 proslijeđeni tweet 109 korisnika označava da im se sviđa
    Poništi
  16. 23. sij

    processes that use bits in windows, SCCM client, browsers, outlook, onedrive & some update programs, powershell one was for testing thus it's not that frequent to have it there and if so likely the transfer job name will be known and can be baselined.

    22 proslijeđena tweeta 55 korisnika označava da im se sviđa
    Poništi
  17. 21. sij

    some "äudit evasion" keywords/cmdlets to watch in "MSExchange Management" event logs or online exchange admin audit logs -->

    15 proslijeđenih tweetova 35 korisnika označava da im se sviđa
    Poništi
  18. 20. sij

    2020: still "2" lines of code to get browsers saved creds and so many security products with no resilient detection/prevention for the same issue

    52 proslijeđena tweeta 215 korisnika označava da im se sviđa
    Poništi
  19. proslijedio/la je Tweet
    20. sij

    The 7th part of the tutorial Hypervisor From Scratch is published! In this part, I described EPT. Thanks to Petr as Hypervisor From Scratch could never have existed without his help and to Alex for patiently answering my questions.

    119 proslijeđenih tweetova 270 korisnika označava da im se sviđa
    Poništi
  20. 17. sij

    learned lessons here are: a) alert on file writes to startup folder by office processes (not noisy) b) monitor continuous network connections from cscript.exe

    7 proslijeđenih tweetova 32 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi

@SBousseaden još nije objavio nijedan Tweet.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·