Prelude’s Tweets

Sep 20

Last #TTPTuesday release for our theme on

@CISAgov

's "2021 Top Malware Strains". This TTP replicates procedures found in #MOUSEISLAND #malware. Check it out on the Prelude Chains Website and see if your machine can detect these procedures.

Are MOUSEISLAND malware procedures mitigated on this host? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Introducing Vertebrae: A security-focused app framework for Python micro services buff.ly/3sSQCSw #cybersecurity

It's #TTPTuesday (somewhere😉) We have two Docker cgroup controller container escapes, as well as a privilege escalation via hostPID. Test your security posture autonomously by following the link: buff.ly/3Enkxcp #infosec #cybersecurity #containersecurity

Is my Docker container vulnerable to cgroup controller escapes? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Doing research & building #cybersecurity products that move the world forward isn't all fun & games. But sometimes, it's just that. Last month our adversary engineers spent a few days doing exploit dev on an neat target: a Flipper Zero. Learn more here:

Exploring file loader crashes on the Flipper Zero

Crashing a Flipper Zero

👇

Quote Tweet

David Hunt

@privateducky

Nov 9

Vertebrae 0.6.8 just released. Using #python to work with #aws? This update adds async support to many cloud services, like S3. Example: use Vertebrae to provision an EC2 vm on the fly. Thanks @khyberspache for the add. #opensource github.com/preludeorg/ver

Nov 8

You betcha: preludeorg.notion.site/Prelude-Jobs-e #infosec #cybersecurity

Quote Tweet

gerbsec

@gerbsec

Nov 8

Replying to @nathanqthai and @GreyNoiseIO

@preludeorg is always hiring :)

Nov 8

We released a new Chain last week. With it came a new Docker container escape TTP in Operator: Is my Docker container vulnerable to host filesystem mounting? Learn more here: buff.ly/3zU1nYJ #infosec #cybersecurity #mitreattack

Is my Docker container vulnerable to host filesystem mounting? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Nov 7

Certain versions of GLPI include a vuln version of HTMLAWED. By submitting a carefully crafted http request to a vuln GLPI server unauthenticated remote code execution is achieved. This TTP attempts to run code on the GLPI server. buff.ly/3DMFD3w #infosec #cybersecurity

Nov 4

Build scalable, security-focused micro services (quickly) with Vertebrae buff.ly/3sSQCSw #redteam #infosec #opensource

Nov 1

#TTPTuesday is here! This week we're sharing a #Docker container escape that mounts the host filesystem to establish persistence. Check out the technique on the Prelude chains website.

Is my Docker container vulnerable to host filesystem mounting? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Nov 1

CVE-2022-35914 : This TTP demonstrates how to run arbitrary code on a vulnerable GLPI server by sending a specially crafted HTTP packet to the GLPI htmlawed module. buff.ly/3DMFD3w #infosec #redteam #preludechains

Nov 1

Vertebrae is a security-focused, all purpose backbone for any Python API. It focuses on one core principle: reducing the lines of code in your application will enable you to write more consistent, more secure code. buff.ly/3sSQCSw #infosec #CloudNative #cybersecurity

we've always been obsessive about clean, simple code. That's why a few months ago we sat down and wrote Vertebrae: a security-focused #microservices framework that encourages tiny code bases. Vertebrae itself is only 448 lines of code.

Build scalable, security-focused micro services - quickly

Vertebrae framework

#TTPTuesday is here! This week we're sharing a #Docker container escape. Check out the technique on the Prelude chains website.

Is my Docker container vulnerable to a Docker socket escape? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Oct 24

Exploiting a #FlipperZero: Exploring File Loader Crashes

@flipper_zero

Exploring file loader crashes on the Flipper Zero

Crashing a Flipper Zero

Oct 18

#TTPTuesday is here! This week we have a GLPI remote code execution TTP for CVE-2022-35914. Click below and see if your current protections can identify or block this technique. #RCE #CVE

Is CVE-2022-35914 patched on this host? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Oct 13

#TTPTuesday is here! This week we have an Atlassian Bitbucket and Data Center code injection exploit for CVE-2022-36804. Click below and see if your current protections can identify or block this technique. #CVE

Is Atlassian Bitbucket Server or Data Center patched against CVE-2022-36804? | Chains | Prelude...

Simple and safe real-world attack chains that make threat intelligence actionable.

Oct 5

#TTPTuesday is here! This week we have an API unhooking technique via #PerunsFart and process injection via #ThreadHijacking. Click below and see if your current protections can identify or block these injection techniques.

API unhooking via Perun's Fart | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Sep 28

#TTPTuesday is here! This week we have two process injection techniques via #CreateRemoteThread and #QueueUserAPC. Click below and see if your current protections can identify or block these injection techniques.

Process injection via CreateRemoteThread | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Our very own

had their #CVE-2022-35256 finding published in

@nodejs

September 22nd 2022 Security Releases. Check out the write-up!

HTTP Request Smuggling in NodeJS

CVE-2022-35256

Sep 13

We are continuing our #CISA's "2021 Top Malware Strains" theme for #TTPTuesday. The TTP this week replicates #Agent #Tesla procedures; with a couple of clicks, you can see if your machine detects them. Check it out on the Prelude Chains Website!

Are Agent Tesla malware procedures mitigated on this host? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Sep 7

We hope you enjoyed the long weekend! For this week's #TTP release, we have two more of #CISA's "2021 Top Malware Strains". Check if your machine can detect #Remcos and #Ursnif malware procedures. Check it out on the Prelude Chains Website!

Are Remcos RAT procedures mitigated on this host? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Aug 31

For this week's #TTP Tuesday, we are releasing #GootLoader and #AZOrult as we continue our theme for #CISA's "2021 Top Malware Strains". Check it out on the Prelude Chains Website!

Are GootLoader malware procedures mitigated on this host? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Aug 23

For #TTP Tuesday we are releasing two more TTPs for our theme focusing on #CISA's "2021 Top Malware Strains". These TTPs emulate some procedures found in #LokiBot and #FormBook malware. Check it out on the Prelude Chains Website!

Can this host mitigate procedures used in LokiBot malware? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Aug 16

We are starting a new TTP Tuesday theme focused on #CISA's "2021 Top Malware Strains". This week, we are releasing two TTPs that emulate #Qakbot and #NanoCore RAT tactics. Check it out on the Prelude Chains website!

Is this host protected from Qakbot? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

in our career workshop at 4pm today with a great panel on "The Hiring Side" of cyber careers with

@InfoSecSherpa

@Krenner

, Caitlin from

& Caroline from ISE. Come check out this in person panel from these amazing women!

Come meet

and Caitlin from the Prelude team in person at the Career Village!

Quote Tweet

The Diana Initiative

@DianaInitiative

Aug 10

Good morning world! @DianaInitiative #TDI2022 has begun! #TakeTheInitiative and join us today and tomorrow both in person in Vegas and online Info: dianainitiative.org

Aug 9

TTP Tuesday has three #CVEs this week. The #CV3s target Spring Cloud Gateway, WSO2's API Manager, and Redis. A few clicks can let you know if these CVEs are exploitable on your systems. Check it out on the Prelude Chains website!

Is Spring Cloud Gateway patched against CVE-2022-22947? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Aug 3

This week's #TTP Tuesday contains two #CVE TTPs, one for Confluence Server and the other for Apache Spark. A couple clicks can let you know if these CVEs are exploitable on your systems. Check it out on the Prelude Chains website!

Is CVE-2021-26084 patched on Confluence? | Chains | Prelude Attack Chains

Simple and safe real-world attack chains that make threat intelligence actionable.

Jul 29

0verture: The Prelude Podcast CVE-EP16 on f33d by Prelude

0verture: The Prelude Podcast CVE-EP16

Listen now (58 min) | What is a TTP? What is wrong with threat hunting classifications and ideas on how to enhance it.

Jul 26

Get two more TTPs with this week's #TTP Tuesday release. Check if your Spring Framework can be exploited via CVE-2022-22965 (#spring4shell) while also finding out if your system can detect Maui #ransomware.

TTP Tuesday: Is CVE-2022-22965 patched on this host?

CVE-2022-22965 (Spring4Shell): Remote code execution in Spring Framework.

Jul 23

0verture: The Prelude Podcast CVE-EP15 on f33d by Prelude

0verture: The Prelude Podcast CVE-EP15

Listen now | Automated Security Software Landscape

Jul 19

Two TTPs are being released for #TTP Tuesday. One that targets CVE-2022-26134 and another that executes a defanged version of Ryuk #ransomware. With a few clicks, check if your system is protected against these #threats.

TTP Tuesday: Is CVE-2022-26134 patched on Confluence?

OGNL injection allows unauthenticated remote code execution

Jul 13

Prelude is a proud sponsor of

@DianaInitiative

! Come visit us at the virtual event this Saturday in the Career Village

Quote Tweet

The Diana Initiative

@DianaInitiative

Jul 12

@DianaInitiative's July 16 #TDI2022 Virtual Conference is in 4 Days!!! #TakeTheInitiative join us & see our amazing speakers & be part of our wonderful villages! Ticket, sponsor, volunteer & villages: dianainitiative.org Schedule: dianainitiative.org/event/2022-sch #infosec

Jul 12

Three #CVE attack tests targeting CVE-2021-41773 and CVE-2021-3156 are included in this #TTP Tuesday release. With a few clicks, check if your system is exploitable. Download now and test it out!

TTP Tuesday: CVE-2021-41773

Apache HTTP path traversal and remote code execution