@Randorfer

Tanium - VP, Cloud Engineering

github.com/randorfer
Joined August 2009
  • Tweets820
  • Following180
  • Followers229
7Media
My Signature Creation Mind Map Input: Sample > the things that I check to create YARA signatures, Sigma rules or IOCs > or pivot to related samples in order to improve the signatures / rules
10
343
8
1,000
1/2 @MayorShepHarris thank you for personally coming out yesterday to help ensure everything that should be done is being done to protect the homes of Bassett Creek during the bridge construction. @LindaIHiggins do you know what is going on with the project?
1
2/2 Yesterday we were told that they would be looking at ways to mitigate the problem more. Today, it looks like the bypass they had in place has been dammed up. Is this just temporary I hope?
Ryan Andorfer retweeted
Jessica Payne@jepayneMSFT26 Jun 2018
At least once a week we encounter a case of lateral movement using off the shelf tools like psexec, command line utilities, or eternal blue. You can stop all of them from moving laterally by blocking SMB and RPC between endpoints using the Windows Firewall channel9.msdn.com/Events/Ign…
10
148
12
399
Ryan Andorfer retweeted
Jessica Payne@jepayneMSFT29 Jun 2018
Windows Event ID 4624 displays a numerical value for the type of login that was attempted. These numbers are important from a forensic standpoint but also for understanding credential exposure and mitigating risks. Descriptions in replies.
20
550
74
1,534
Ryan Andorfer retweeted
Jessica Payne@jepayneMSFT26 Jun 2018
Have a practice IR. This may look different than you’re expecting. Can you: 1) deploy software or a script to ALL endpoints without errors? 2) identify all your endpoints? 3) know what your patch or configuration deployment status is for a basic item like KB2871997 or a GPO?
4
28
1
116
Ryan Andorfer retweeted
hasherezade
@hasherezade27 Jun 2018
Cool series about #KernelMode #rootkits by @TigzyRK : 1) adlice.com/kernelmode-rootki… 2) adlice.com/kernelmode-rootki… 3) adlice.com/kernelmode-rootki…

KernelMode Rootkits, Part 1 | SSDT hooks • Adlice Software

KernelMode Rootkits explained. This is the first part of this rootkit writing tutorial and it covers SSDT/Shadow hooks.

adlice.com
3
182
1
318
Detecting Lateral Movements in Windows Infrastructure cert.europa.eu/static/WhiteP…
2
223
6
384
Ryan Andorfer retweeted
John Lambert
@JohnLaTwC10 Jun 2018
In Pike Place Market, you may have come across the Market Penmaker. He made pens and mechanical pencils from woods around the world. I have given them as gifts to friends and acquaintances. He died last month, but I thought his work so beautiful I wanted to share it.
1
8
2
58
dotnet new -i Microsoft.PowerShell.Standard.Module.Template dotnet new psmodule 👆BOOM A #PowerShell Standard-ready C# module. One cross-plat codebase for a module that works on PS 5.1 & PS Core 6 (or PS 3+) 🚀⚡️ NuGet nuget.org/packages/Microsoft… Repo github.com/PowerShell/PowerS…

Microsoft.PowerShell.Standard.Module.Template 0.1.3

Creates a PowerShell Standard based C# module.

nuget.org
7
19
2
49
Ryan Andorfer retweeted
Nick Carr
@ItsReallyNick13 May 2018
Fun fact: the WMI EventFilter registered by this #DailyScriptlet for persistence leverages TargetInstance.SystemUptime to specify a launch time range (in seconds). For malware, the range is often chosen to allow the system to fully boot then launch once. Method in Vault 7 leak. xitter.cf/ItsReallyNick/status/9…
Nick Carr
@ItsReallyNick11 May 2018
How about a #DailyScriptlet with spicy VBS obfuscation using split, eval, and chr arithmetic Launches: 1⃣ Metasploit-style shellcode 2⃣ Registry persistent remote mshta 3⃣ WMI persistent #squiblydoo [pictured] cc: @cglyer "reg9.sct" uploaded this week: virustotal.com/#/file/596088…
2
74
2
157
Ryan Andorfer retweeted
Aaron Hnatiw@AaronHnatiw8 May 2018
*the sound of a thousand hackers cheering simultaneously around the world* bleepingcomputer.com/news/mi…

Microsoft Adds Support for JavaScript Functions in Excel

At the Build 2018 developer conference that's taking place these days in Seattle, USA, Microsoft announced support for custom JavaScript functions in Excel.

bleepingcomputer.com
38
411
85
803
Poor pentesters, getting up every day to discover & report that software is broken & security concepts are flawed. It takes some time to realise that it'll always stay that way. Become a defender! We kick ass, fight back real adversaries & ruin the day of criminal scumbags.
15
92
7
260
Magic Wormhole Get things from one computer to another, safely. > I just made my first 381MB file transfer - awesome project magic-wormhole.readthedocs.i…
7
167
13
442
Ryan Andorfer retweeted
bohops
@bohops28 Apr 2018
[Blog] Abusing DCOM For Yet Another Lateral Movement Technique ....unsophisticated, but may have some utility wp.me/p7MIao-6H
2
92
1
172
Ryan Andorfer retweeted
Oddvar Moe
@Oddvarmoe19 Apr 2018
A good documentation on all the different #LOLBins and #LOLScripts would be nice? Right? Good thing I have started then. Still have a lot of notes to add, but I feel this is a good start. Would love community feedback and contributions. Is this useful? github.com/api0cradle/LOLBAS
22
292
11
498
Ryan Andorfer retweeted
🔎Julia Evans🔍
@b0rk20 Apr 2018
memory allocation
72
1,982
96
6,392
Ryan Andorfer retweeted
Andy Robbins@_wald018 Apr 2018
You can easily determine what GPOs apply to the members (direct and unrolled) of a given security group. We'll add this to the #BloodHound interface soon.
3
60
177
Ryan Andorfer retweeted
bohops
@bohops19 Apr 2018
Is Explorer.exe the ultimate #lolbin? explorer.exe [exe/hta/scr/...etc] *Invokes child processes when called (after a lookup of the the default program handler) *Hides from the default filter in AutoRuns *Just might be doing a little more on a workstation in your network #DFIR
4
154
4
279
Load more