@MetallicHack

🇨🇵 Cybersecurity engineer enjoying Windows & AD security, DFIR and detection engineering @TheDFIRReport analyst

Joined November 2020
  • Tweets945
  • Following392
  • Followers833
For CVE-2022-41040 and CVE-2022-41082, you should definitely keep an eye on w3wp (IIS worker process) activities. Audit process creation and hunt for suspicious w3wp children process (for instance whoami 🙃)
Microsoft Threat Intelligence
@MsftSecIntel1 Oct 2022
Microsoft Security Threat Intelligence teams have published additional analysis on observed exploitation of Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082 with security product mitigations and detections to help protect against further attacks msft.it/6010dE3KO
2
4
Keep an eye on suspicious service creation 👀🐝 #Bumblebee #DFIR
The DFIR Report
@TheDFIRReport26 Sep 2022
BumbleBee: Round Two ➡️Initial Access: Bumblebee ISO>LNK>DLL ➡️Persistence: AnyDesk, Added Local Admin ➡️Discovery: LOLbins, AdFind ➡️Credentials: LSASS Dump ➡️Lateral: SMB, Remote Services, RDP ➡️C2: Bumblebee, Meterpreter, CobaltStrike thedfirreport.com/2022/09/26…

BumbleBee: Round Two - The DFIR Report

In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee has been identified as an initial access vector utilized by several ransomware affiliates. In...

thedfirreport.com
1
3
Replying to @IcsNick @TheDFIRReport
@IcsNick @TheDFIRReport
1
Replying to @_nwodtuhs
Let s go 😁
1
CVE-2022-26923 be like
10 LDAP CVE, one RCE CVSS 9.8
DirTeam.com@DirTeamCom10 May 2022
The May 2022 Patch Tuesday addresses 10 LDAP Remote Code Execution vulnerabilities (Critical, CVSSv3 9.8) ift.tt/sjZAge9 #DirTeam

The May 2022 Patch Tuesday addresses 10 LDAP Remote Code Execution vulnerabilities (Critical,...

When looking at the May 2022 Patch Tuesday today, I noticed ten updates that specifically address Remote Code Execution (RCE) vulnerabilities in Windows LDAP. These vulnerabilities are specific to...

dirteam.com
Nice report by @Kostastsale @iiamaleks and @pigerlin ! I really enjoy the part when threat actors try to enable “Restricted Admin Mode” in order to abuse it 😂
The DFIR Report
@TheDFIRReport9 May 2022
SEO Poisoning – A Gootloader Story ➡️Initial Access: Gootloader ➡️Discovery: BloodHound, Port Scanning ➡️Credential Access: LaZagne & Mimikatz ➡️Defense Evasion: Defender Service Deletion ➡️Lat Movement: Remote Service Creation & RDP ➡️C2: #CobaltStrike thedfirreport.com/2022/05/09…

SEO Poisoning - A Gootloader Story

In early February 2022, we witnessed an intrusion employing Gootloader (aka GootKit) as the initial access vector.The intrusion lasted two days and comprised discovery, persistence, lateral movement,...

thedfirreport.com
3
7
These process event chains 👀 #dfir #FIN7
Mandiant (part of Google Cloud)
@Mandiant4 Apr 2022
Our new research shows #FIN7 has increased the speed of their operational tempo, the scope of their targeting, and for the first time ever, we’ve observed FIN7 leverage #supplychain compromise. Read more in our latest post ⤵️ mndt.info/3DG49Bv
1
8
21
Replying to @MetallicHack @Kostastsale
@Kostastsale
1
Matt Zorich
@reprise_992 Dec 2021
#AzureAD Kerberos authentication 👀docs.microsoft.com/en-us/azu…

Store FSLogix profile containers on Azure Files using Microsoft Entra ID - FSLogix

Set up an FSLogix profile container on an Azure file share with your Microsoft Entra domain.

learn.microsoft.com
1
Load more