Cloud Threat Research and Detection Engineering is our Priority Zero (p0) at Permiso Security.
Joined March 2022
- Tweets34
- Following31
- Followers106
- Likes37
p0 Labs retweeted
An area needing attention for protecting modern applications against threats👇
-access via IDP identities
-LUCR-3 uses SaaS applications to learn how the victim organization operates and how to access sensitive information."
#cloudsecurity #iam #sspm #appsec @permisosecurity
Beware of LUCR-3! 🚨 Threat actor that overlaps with Scattered Spider, Oktapus, UNC3944, & STORM-0875, they exploit IDPs for initial access & aim to steal IP for extortion. They use victims' tools and evade detection with expertise. @permisosecurity
permiso.io/blog/lucr-3-scatt…
p0 Labs retweeted
An iPhone user suddenly having an Android is 🚨
This Post is from an account that no longer exists. Learn more
p0 Labs retweeted
Dadgum, this is a good and content-rich read. Lots of crisp TTPs to consider detections for. permiso.io/blog/lucr-3-scatt… // hat tip @permisosecurity @TekDefense
p0 Labs retweeted
New joint release with our friends at @permisosecurity / @P0Labs 👇
AWS-Targeting Cred Stealer Expands to Azure, GCP
💜 s1.ai/cloudcreds
💜 permiso.io/blog/s/agile-appr…
@spiderspiders_ @TekDefense @danielhbohannon #ThreatIntel
p0 Labs retweeted
Beware of LUCR-3! 🚨 Threat actor that overlaps with Scattered Spider, Oktapus, UNC3944, & STORM-0875, they exploit IDPs for initial access & aim to steal IP for extortion. They use victims' tools and evade detection with expertise. @permisosecurity
permiso.io/blog/lucr-3-scatt…
p0 Labs retweeted
📴Hopefully your org doesn't allow SMS for 2FA (especially for privileged accounts in Azure AD).
Don't stop at disabling it. Monitor for threat actors trying to modify it. Nice transparency into threat actor tampering & recommendations @TekDefense/@p0Labs
📰Full blog: permiso.io/blog/lucr-3-scatt…
p0 Labs retweeted
Excellent 🆕blog from @permisosecurity on the most disruptive criminal intrusion set we're all working on. Blog details evasive techniques scattered across SaaS & multi-cloud environments.
ALT LUCR-3 / Storm-0875 techniques scattered across multiple cloud services
Beware of LUCR-3! 🚨 Threat actor that overlaps with Scattered Spider, Oktapus, UNC3944, & STORM-0875, they exploit IDPs for initial access & aim to steal IP for extortion. They use victims' tools and evade detection with expertise. @permisosecurity
permiso.io/blog/lucr-3-scatt…
p0 Labs retweeted
Keep an eye out for usage of deprecated #AWS policies. @gl4ssesbo1 makes his @permisosecurity @P0Labs blog debut talking about the dangers of the deprecated policy AmazonEC2RoleforSSM permiso.io/blog/s/deprecated…
p0 Labs retweeted
Here @permisosecurity the focus is on detection of #identity and #cloud threat activity. #Detection can be an art form with various methodologies. In this article we describe our approach to detection using AndroxGh0st and GreenBot as an example!
permiso.io/blog/s/approach-t…
p0 Labs retweeted
.@TekDefense & the @permisosecurity p0 Labs team get it.
This time showing you how older techniques like HIST* mods can be combined with new signal to hunt for credential harvesting campaigns
$hist1 = "HISTSIZE=0"
$hist2 = "unset HISTFILE"
🆕 permiso.io/blog/s/christmas-… 🎅
Linux #DFIR reminders:
1⃣ Trojanized binaries are still a popular Linux infection vector - along with classics like web shells, tunnelers, & simple bash scripts
2⃣ HISTFILE modification behavior is suspicious - and detection may be as simple as HISTFILE string in ELF binaries
p0 Labs retweeted
🔖 Cloud Cred Harvesting Campaign
A credential harvesting campaign targeting cloud infrastructure. The majority of the victim system were running public facing Juptyer Notebooks. From @permisosecurity
permiso.io/blog/s/christmas-…
p0 Labs retweeted
@permisosecurity & @ExpelSecurity both writing a blog within a week of each other explaining how threat actors are exploiting the Simple Email Service (SES) within #aws. Please read and learn from these articles! permiso.io/blog/s/aws-ses-pi… #cloud #threatdetection
p0 Labs retweeted
🔖 SES-pionage
What do attackers do with exposed AWS access keys? This blog looks inside AWS SES to give deeper insights into the service, why & how its targeted and how to detect it. From @permisosecurity
permiso.io/blog/s/aws-ses-pi…
p0 Labs retweeted
Meet the @P0Labs team: #pixelart version. #FollowFriday @permisosecurity
@Security_Nate
@danielhbohannon @gl4ssesbo1 @akraut
p0 Labs retweeted
Cloud Apps Still Demand Way More Privileges Than They Use darkreading.com/tech-trends/… via @darkreading @permisosecurity #CSPM #AppSec
p0 Labs retweeted
Last week we @permisosecurity wrote an article permiso.io/blog/s/watering-h… speaking to a #google ads phishing campaign targeting #brazilian #AWS users.
@TomHegel discovered the next phase of the attackers campaign, catch the details from the @SentinelOne team sentinelone.com/blog/cloud-c…
p0 Labs retweeted
2022 was a great year for the @permisosecurity @P0Labs team. Hundreds of hours dedicated to researching, detecting, and helping our clients responds to #cloud attacks. Here are some of our observations:
permiso.io/blog/s/permiso-20…
p0 Labs retweeted
Compromised Access Keys aren't the only vector for #cloud Attacks. Checkout our (@permisosecurity ) latest article where we detail an ongoing wateringhole attack targeting #AWS management console users via #google ads.
permiso.io/blog/s/watering-h…
Checkout some of the great research from the @permisosecurity @P0Labs team from last year:
1. #Okta Impersonation: permiso.io/blog/s/down-with-…
2. Anatomy of an #AWS attack: permiso.io/blog/s/anatomy-of…
3. #Cloud Cred Harvesting: permiso.io/blog/s/christmas-…
... and more!
p0 Labs retweeted
I'm super excited to announce that I've joined @permisosecurity as a Principal Security Researcher!
Stoked to be reunited with the fiercely fun & technical @TekDefense on the @P0Labs research team. Several weeks in & I'm super impressed by the team, tools, data & capabilities.
ALT Cyan Permiso Security logo in ASCII art with the yellow message "@dbo goto permiso.io" underneath the logo.