Izy retweeted
Check out GoLinHound:
- Discovers Linux & SSH attack paths
- Outputs OpenGraph JSON for BloodHound ingestion
- Integrates with SharpHound and AzureHound data to unveil cross-technology attack paths
github.com/RantaSec/golinhou…
Izy retweeted
Catch @IzySec's recent podcast discussing Rogue Remote Desktop Protocol: open.spotify.com/episode/5AG…
Izy retweeted
Signed .rdp files are being used to trick users.
GTIG observed a novel #phishing campaign targeting European government and military organizations, and has attributed it to a suspected Russia-nexus #espionage actor tracked as UNC5837.
Read the details: bit.ly/4jrDcFD
Izy retweeted
1) I didn't know .RDP config files could be signed
2) RDP RemoteApps are crazy
3) I always appreciate a Fuzzy Snuggly Duck
cloud.google.com/blog/topics…
Izy retweeted
Neat blog on RDP tradecraft, includes examples, practical recommendations on hardening, detection ideas etc.
Having convertible detection content is great, no doubt. What I think is underrated is blueteam-focused tradecraft intel. Red teams share it all the time, we should too.
A threat group recently showed creativity with a known technique. Here's how it worked
cloud.google.com/blog/topics…
Having convertible detection content is great, no doubt. What I think is underrated is blueteam-focused tradecraft intel. Red teams share it all the time, we should too.
A threat group recently showed creativity with a known technique. Here's how it worked
cloud.google.com/blog/topics…
Some solid work done by the team! Give them a read :)
🌶️ Active Fortinet Zero-Day Exploitation ITW 🌶️
cloud.google.com/blog/topics…
#zeroday #fortinet #inthewild
Izy retweeted
Windows audit policies, the events they enable and the relative volume of events they generate
#ThreatHunting #DFIR
A sister team of mine is hiring. They do hard core detection engineering. You will be analyzing things you won't see elsewhere and writing a variety of content to detect it. Super technical role alongside some great folk.
I'm excited to announce that I'm hiring two Detection Engineers for the Mandiant Detection Engineering Team! Come build detections at a global scale for cutting edge threats on an amazing team.
Apply here google.com/about/careers/app…
#DetectionEngineering #Mandiant #Detection
Izy retweeted
Wondering what telemetry an EDR collects?
Wonder no more! @Kostastsale and @ateixei run an EDR Telemetry Project, covering all major EDRs:
"The main goal of the EDR Telemetry project is to encourage EDR vendors to be more transparent about the telemetry they provide".
Blog: detect.fyi/edr-telemetry-pro…
Table: docs.google.com/spreadsheets…
Github: github.com/tsale/EDR-Telemet…
#redteam #blueteam #telemetry
Izy retweeted
Small experiment today, inspired by @kaganisildak, using RCON protocol, as used by e.g. CS 1.6 as a C2 channel for the lulz
Izy retweeted
It's a bittersweet moment, but our series of "Attacking an EDR" has come to an end! Me and @Her0_IT hope that you had as much fun reading it as we had writing it.
riccardoancarani.github.io/2…
Izy retweeted
I've just released the next edition of the On Detection series. I investigate why detection rules based on Process Creation are often brittle or easily bypassed. I also provide a framework for discerning when it is appropriate and when it isn't.
posts.specterops.io/on-detec…
Izy retweeted
So far I've written 559 pages to help the security community:
1. exploitreversing.com/2021/12…
2. exploitreversing.com/2022/02…
3. exploitreversing.com/2022/05…
4. exploitreversing.com/2022/05…
5. exploitreversing.com/2022/09…
6. exploitreversing.com/2022/11…
7. exploitreversing.com/2023/01…
8. exploitreversing.com/2023/04…
Izy retweeted
I've just released the 9th part of my On Detection series. In this post I demonstrate that we see actions in cyberspace at the Operational level and what that means for detection engineers.
posts.specterops.io/on-detec…
Izy retweeted
Great overview table of accounts that belong to tier 0. #mustView for every Sec and AD specialist.
[Repo] TierZeroTable
specterops.github.io/TierZer…
#CyberSecurity #Identity #SpecterOps #shiftavenue
Izy retweeted
mandiant.com/resources/blog/… In March of this year we began seeing similar blending efforts that we saw DPRK do during the pandemic, then 3CX popped off giving us more insight, then Andariel’s ROCKHATCH malware popped off with fingerprints of two other APTs in it….
Izy retweeted
Cisco intends to acquire Splunk:
newsroom.cisco.com/c/r/newsr…
