xknow

@xknow_infosec

🦄 InfoSec Enthusiast 🐻Always up for new intel 👽 Deep Dive!

Germany
Vrijeme pridruživanja: ožujak 2019.
7 fotografija ili videozapisa Fotografije i videozapisi

Tweetovi

Blokirali ste korisnika/cu @xknow_infosec

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @xknow_infosec

  1. proslijedio/la je Tweet
    16. sij

    interesting sample, uses ShellWindows COM to bypass suspicious office child processes, try to download calc.bin from a likely legit/compromised bitcoin related website:

    30 proslijeđenih tweetova 98 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  2. proslijedio/la je Tweet
    17. sij

    Hunting in Sentinel is now in public preview so you can get started with livestream sessions and check it out

    1 reply 58 proslijeđenih tweetova 168 korisnika označava da im se sviđa
    Poništi
  3. proslijedio/la je Tweet
    14. sij

    Actually, that was a tracker. "Steve" is using an iPhone and is in Lagos, Nigeria (using the same IP address as Katy, who received a slightly different file).

    105.112.58.199 - - [14/Jan/2020:16:59:33 +0000] "GET /redeem HTTP/1.1" 302 215 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
    105.112.58.199 NG Lagos, Lagos, Nigeria, Africa 105.112.58.0/24
    95 proslijeđenih tweetova 512 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  4. proslijedio/la je Tweet
    15. sij

    CredAccess: some keyword you can add to the list of suspicious powershell scriptblock keywords_list, you can also monitor suspicious ImageLoad of the 2 highlighted ones (see below) Tool:

    27 proslijeđenih tweetova 75 korisnika označava da im se sviđa
    Poništi
  5. proslijedio/la je Tweet
    16. sij

    Proof-of-concept exploits published for the Microsoft-NSA crypto bug (CVE-2020-0601) * Two are public (via & ), at least one is private () * People are calling this bug CurveBall now

    40 proslijeđenih tweetova 65 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  6. proslijedio/la je Tweet
    16. sij

    CVE-2020-0601 - PoC for code signing PE files using a Certificate Authority using ECC

    5 replies 336 proslijeđenih tweetova 578 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  7. proslijedio/la je Tweet
    16. sij

    That epic Microsoft moment❤️ Recently worked on and ECC, so yes, 10 and 2016/2019 only. Previous versions like Windows 7 did not support personnal EC curves (only few NIST standard ones)

    8 replies 368 proslijeđenih tweetova 813 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  8. proslijedio/la je Tweet
    14. sij

    No fancy EDR required to capture CVE-2020-0601 attempts (after patching). Just ensure you're forwarding Application log events. Currently, CVE-2020-0601 is the only Microsoft code (AFAIK) that calls the CveEventWrite API so event noise is not a concern.

    8 replies 201 proslijeđeni tweet 463 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  9. proslijedio/la je Tweet
    15. sij

    Sigma rule to detect the exploitation of CVE-2020-0601 as noted by Reference - built-in feature, no Sysmon required - rule is generic & detects all future events generated by this source Rule

    1 reply 105 proslijeđenih tweetova 176 korisnika označava da im se sviđa
    Poništi
  10. 15. sij

    Detect possible upcoming exploits of CVE-2020-0601 (vuln in Win CryptoAPI, Elliptic Curve Cryptography) VIA Zeek --> <-- full credits to Johanna A.

    1 proslijeđeni tweet 1 korisnik označava da mu se sviđa
    Poništi
  11. proslijedio/la je Tweet
    15. sij

    Great technical thread on doing incident investigation on boxes owned with

    CVE-2019-19781 Live Response First Steps ========================= Some tips on how to go about running a micro-compromise assessment on Netscaler boxes, this is what I've been using: >>> Check the root user command history: history /1
    Prikaži ovu nit
    13 proslijeđenih tweetova 31 korisnik označava da mu se sviđa
    Poništi
  12. proslijedio/la je Tweet
    15. sij

    Azure AD privilege escalation - Taking over default application permissions as Application Admin - Azure AD security == just saying 😅

    43 proslijeđena tweeta 94 korisnika označavaju da im se sviđa
    Poništi
  13. proslijedio/la je Tweet
    15. sij

    If you haven't done so already, go download and update UFED to 7.28! Make sure you hit the correct portal to update:

    1 reply 6 proslijeđenih tweetova 19 korisnika označava da im se sviđa
    Poništi
  14. proslijedio/la je Tweet
    15. sij

    CVE-2019-19781 Live Response First Steps ========================= Some tips on how to go about running a micro-compromise assessment on Netscaler boxes, this is what I've been using: >>> Check the root user command history: history /1

    15 replies 162 proslijeđena tweeta 326 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  15. proslijedio/la je Tweet
    14. sij

    traces of this new LM tool can be found in the ATT&CK_EVTX repo :

    45 proslijeđenih tweetova 117 korisnika označava da im se sviđa
    Poništi
  16. proslijedio/la je Tweet
    15. sij

    A perfect summary of the Windows CryptoAPI spoofing vulnerability CVE-2020-0601 that Microsoft patched today. Like the old adage says, two screenshots are worth a thousand words.

    Tweet je nedostupan.
    52 proslijeđena tweeta 91 korisnik označava da mu se sviđa
    Poništi
  17. proslijedio/la je Tweet
    14. sij

    We'll see and APT move laterally via RDP using Windows service accounts. Configure your to alert when you see type 10 remote interactive logons from Windows service accounts. You may be surprised as what you see. 😀

    11 replies 114 proslijeđenih tweetova 352 korisnika označavaju da im se sviđa
    Poništi
  18. proslijedio/la je Tweet
    15. sij
    Odgovor korisnicima

    Finding service accounts: * Account has a SPN * kerberos delegation configured * password not changed in over $(Policy time) * svc or service or SQL in name That should help get you started. 👍

    4 proslijeđena tweeta 23 korisnika označavaju da im se sviđa
    Poništi
  19. proslijedio/la je Tweet
    14. sij

    Most defenders know about the matrix for Windows, but did you also know there's one for Linux? Want to see it in action? Read this post by a MSTIC analyst on a threat seen in : 👉 🔗

    106 proslijeđenih tweetova 251 korisnik označava da mu se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  20. proslijedio/la je Tweet
    13. sij

    I've been poking around the Windows kernel a lot lately and one of my favorite samples I've referenced is Mimikatz's driver, Mimidrv. I took some time and documented all of its functions and included some write-ups on important kernel structures. Post: 1/3

    266 proslijeđenih tweetova 517 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi

@xknow_infosec još nije objavio nijedan Tweet.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·