New blog post on threat hunting queries for SocGholish malware.
pjstaley.com/hunting-for-soc…
#CyberSecurity #ThreatHunting #malware
PJS_CyberSecurity retweeted
Yesterday Lockbit ransomware group listed Boeing on their victims list. Boeing is a multinational American company with an estimated annual revenue of $66,610,000,000. They have over 150,000 employees worldwide. Boeing serves both the public and private sector.
We spoke with Lockbit ransomware group administrative staff yesterday regarding Boeing. They informed us that they have not yet spoke with a representative from Boeing and they will not disclose any information to us about Boeing - more specifically they would not give us insights into how long they had access to Boeing, how much data was exfiltrated, what kind of data was stolen, etc.
Lockbit stated their ransomware affiliate got access using a 0day exploit. However, Lockbit would not elaborate further on this exploit hence we cannot verify the legitimacy of these claims.
It is also probably worth noting that most victims listed by Lockbit are given 10 days (or more) to begin negotiations. Lockbit gave Boeing less than 6 days
List of MediaArena browser hijackers
northwave-cybersecurity.com/…
Gifsearchutils
Gifsmakerpro
PdfHub
PdfMagic
PdfMagicApp
PdfPower
PdfShark
Screensearchutils
Screensrecorder
Searcharchiver
Searchpoweronline
Searchtoolshub
Sharksearchonline
Ziplikeapro
Ziplikeaproapp
Ziprararchiver
cert.gov.ua/article/5702579 - Detection on --headless
DeviceProcessEvents
| where FileName contains "msedge.exe" or FileName contains "curl.exe"
| where InitiatingProcessCommandLine contains "--headless=new"
PJS_CyberSecurity retweeted
Qakbot botnet dismantled after infecting over 700,000 computers - @serghei
bleepingcomputer.com/news/se…
Want to hunt for VPN/proxy usage? Microsoft adds this IP tag when activity is facilitated through a personal VPN application. #CyberSecurity #kql #threathunting
CloudAppEvents
| where TimeGenerated > ago(1d)
| where IPTags has "Anonymous proxy"







